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HUMAN-CENTERED TECHNOLOGIES AND PROCEDURES 
FOR FUTURE AIR TRAFFIC MANAGEMENT 

1. Executive Summary and Conclusions 

Philip Smith*, David Woods*, Elaine McCoy**, Charles Billings*, 

Nadine Sarter***, Rebecca Denning*, Sidney Dekker* 

‘Cognitive Systems Engineering Laboratory 
The Ohio State University, Columbus, Ohio 

“Department of Aviation 
Ohio University, Athens, Ohio 

“‘Institute of Aviation — Aviation Research Laboratory 
University of Illinois at Urbana-Champaign 

Introduction 

In this project, we have been exploring the use of various methodologies to predict 
the impact of future Air Traffic Management (ATM) concepts and technologies. In 
applying these methodologies, our emphasis has been on the importance of 
modeling coordination and cooperation among the multiple agents within this 
system, and on understanding how the interactions among these agents will be 
influenced as new roles, responsibilities, procedures and technologies are 
introduced. To accomplish this, we have been collecting data on performance 
under the current air traffic management system, identifying critical problem areas 
and looking for exemplars suggestive of general approaches for solving such 
problems. Using the results of these field studies, we have developed a set of 
concrete scenarios centered around future system designs, and have studied 
performance in these scenarios with a set of 40 controllers, dispatchers, pilots and 
traffic managers. 

In a preliminary report submitted on 19 July 1996 (Smith, Woods et al., 1996), we 
provided NASA with a compendium of the major recommendations that had 
resulted from our research under the AATT Program to that date. 
Recommendations 1-3 dealt with general approaches that our findings suggested 
should be incorporated in future AATT Program activities, while 
Recommendations 4-11 identified some specific topics and technologies that merit 
research and development activities. Those recommendations are repeated here. 

This summary is organized as follows. Section 1 describes the general design 
philosophy that is supported by our empirical studies. Section 2 briefly summarizes 
the research methods we have used to identify requirements for future system 
designs and to evaluate alternative design solutions. These methods are discussed 
in detail in report no. 2 in this volume. Section 3, and reports 3-7 in this volume, 
discuss results from several investigations that we have conducted using these 
research methods. Section 4 provides an overall summary of the section. 
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1.1 Proposed Design Philosophy 

Our central conclusion is that attempts to improve the safety and efficiency of the 
air transportation system must take a human-centered approach to support the 
cooperative problem-solving of both airborne and ground-based operators. The 
impact of new ATM concepts and technologies must be considered in the context of 
the roles, responsibilities and interactions of the people using them, in terms of 
procedures and the regulatory environment, in terms of organizational behavior, 
and in terms of the different types of situations or scenarios that arise in such a 
system. 

In particular, design efforts must explicitly take into consideration the distributed 
nature of this system, which includes human and computerized agents with 
multiple complementary and competing goals and overlapping responsibilities, 
who at times have different sources of information and differing situation 
assessments. Furthermore, we must study how this system, with all of its complex 
interactions, can evolve from its current state. We need to start with an 
understanding of interactions within the current system, and then take a hard- 
headed approach, asking where the real problems lie, and determining where 
opportunities for improvement with significant payoffs really exist. 

Thus, our focus has been on how the participants within the ATM system can 
coordinate their activities to achieve overall safety and economic goals. We believe 
this is the appropriate project focus because a fully autonomous air traffic 
management system, whether air- or ground-based, is not likely to be technically 
possible or desirable in the foreseeable future given the dynamic and uncertain 
nature of the national airspace system. 

We believe that the allocation of resources for future system development should 
be based on a broad systems perspective, with emphasis on how system elements 
interact and how they are to be integrated. One set of methods that can help to 
accomplish this goal is to construct and use concrete scenarios that focus attention 
on the necessary interactions among participating agents in proposed ATM systems. 
Such scenarios can also focus attention on requirements for new technologies in a 
future system. 

We believe that it is important to use empirical methods to provide a basis for 
developing informed judgments about alternative system enhancements and that 
such work should take place early in the design process. This requires examining 
the implications of alternative design proposals in rich, realistic contexts, using 
experienced practitioners to generate predictions about performance in such future 
designs. To be cost-effective, the design process also needs to include methods that 
allow exploration at different levels of fidelity. 
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1.2 Methods for the Development of Future System Requirements 
1.2.1 Introduction 

One important question in the development of a future ATM system is 
methodological: How can we identify system requirements for new ATM concepts 
and technologies, recognizing the potential for these changes to create new roles and 
procedures for individual participants, new forms of coordination across personnel 
and organizations, and new types of information to communicate, assess and 
integrate? This is difficult in part because the system of interest does not yet exist. A 
further challenge arises because many details of this future system design are 
underspecified. To design and test these new roles before committing large pools of 
resources, we need a method to quickly prototype and study how the people and 
technologies will coordinate in realistic operational scenarios for different ATM 
concepts. 

Different developers, stakeholders and decision makers are each likely to develop 
their own insights and views on how the whole system will work in the future. 
Consequently, another challenge is how to rigorously explore the many 
implications of these different viewpoints. For without doing so, it would be easy to 
oversimplify the impact of a new system on the roles, decisions, coordination needs, 
and information requirements of the people involved in the ATM system. 

These characteristics — a still underspecified system design, accompanied by the 
potential to oversimplify the impact of design decisions on people's roles and 
activities — create a difficult methodological challenge. Figure 2-1, p. 2-3, illustrates a 
range of techniques available to investigate possible characteristics and design 
choices for the future ATM system. This space of methods reveals a basic tradeoff: 
methods that are high on both dimensions in the figure can only be deployed 
relatively late in the development process and tend to be resource intensive. How 
can we generate the needed information to support decisions about the 
development of new ATM concepts and technologies in a cost-effective and timely 
manner? 

In planning for the future of the AATT program, NASA needs to consider the 
appropriate mix and timing for using these different methods. We have been using 
methods that balance cost, timeliness, degree of control, face validity and 
environmental richness to provide input to system developers early in the design 
process. The methods we have used to support requirement identification are: 

• empirical— collecting data about how people may carry out new roles and utilize 
possible new systems, thus helping to identify potential problems and define 
requirements for system development. 

• scenario driven— rigorously exploring the implications of new ATM concepts 
and technologies by having different kinds of expert practitioners explore them 
in the context of concrete situations. 

• iterative and converging-using multiple approaches that build on each other 
and converge on results that can support design decisions. 
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The end result for us has been an emphasis on different forms of CONCEPTUAL 
WALKTHROUGHS. In these conceptual walkthroughs, we posit a future ATM system, 
or parts of it, through development of a concrete scenario that instantiates a 
situation within that future system. We then collect data by asking aviation 
practitioners with different areas of expertise to evaluate or play out potential roles 
and interactions under that scenario, identifying how it could work and where it 
might be vulnerable. Report no. 2 in this volume describes these methods in detail. 

1.2.2 Research Methods for Studying the Existing Aviation System 

To understand the changes in human performance that may occur as we consider 
new ATM concepts and technologies, we have studied the effects of changes that are 
currently underway. Our work has drawn upon efforts focused on documenting 
and modeling performance in the existing system, with an emphasis on new FAA 
initiatives (the expanded National Route Program and the MAR program). This 
work has a broad systems perspective, examining how system elements interact in 
the context of real world factors. These studies of the existing ATM system are a rich 
stimulus for the development of scenarios to guide our exploration of the 
consequences of different technologies and designs on human performance in a 
future system. They provide a conceptual framework to guide the use of techniques 
such as conceptual walkthroughs. (See report no. 3 in this volume.) 

Equally important, we believe that these studies, by taking a broad systems 
perspective, have served to provide important insights into how system elements 
are integrated and how they interact. Of particular importance is their emphasis on 
the impact of new technologies on the roles, responsibilities and interactions of the 
people using them, in terms of the regulatory environment, organizational 
behavior, and the different types of situations or scenarios that arise. 

Recommendation 1: The AATT Program should continue to fund significant 
efforts to study and model the impact of changes currently being made or 
planned within the existing aviation system. These studies should take an 
integrated systems view in collecting and analyzing data, specifically 
addressing the interaction and coordination among the multiple agents 
within this system. These studies will help to further identify problem areas 
and provide objective data to guide decisions about future system 
development. 

1.2.3 Research Tools for Studying Future Systems 

Since the system of interest does not yet exist, we have used conceptual 
walkthroughs of possible future ATM worlds to study their impact on human roles, 
decisions, coordination requirements and information needs. In preparing for these 
conceptual walkthroughs, we developed scenarios that instantiate various generic 
issues or challenges for air traffic management and posit a hypothetical ATM world, 
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or parts of it, in terms of proposed technologies or procedures. Experts representing 
different roles and perspectives within the ATM system then think through or play 
out their potential roles, interactions and information needs within those scenarios. 
We do not provide detailed simulations; rather we ask the participants to describe 
in detail how such systems would have to function to provide support so that they 
could accomplish their tasks successfully. (Report no. 2 in this volume describes 
these methods in detail. See reports nos. 4 and 5 for examples of the data obtained 
from conceptual walkthroughs in this study.) 

Critical to this method is the use of concrete scenarios to anchor the participants in 
the details of the coordination, communication, decision making and information 
exchange requirements necessary to handle the situation successfully. In addition, 
we have found that having multiple participants representing different perspectives 
about the ATM system maximizes the information generated by such scenario- 
driven conceptual walkthroughs. Anchoring people in concrete situations quickly 
reveals ambiguities about what their roles are and about how they would carry out 
those roles. Having people with different perspectives explore how to deal with 
these roles and interactions provides insights about how different people and 
organizations can coordinate to achieve all of the parties' goals for a safe, efficient 
and economical ATM system. 

We have constructed a number of scenarios and used them in several conceptual 
walkthroughs to demonstrate the value of this approach. The scenarios developed 
to date address several kinds of issues for the development of future ATM systems 
such as transitions in method or locus of control (e.g., the transition from free flight 
rules to controlled airspace) and factors limiting system capacity (e.g., crossing traffic) 
among others. However, these scenarios represent only an initial exploration of the 
kinds of factors that should be considered. 

Recommendation 2: Develop a set of scenarios that represents as fully as 
possible the range of tasks and situations that must be considered in 
designing components of a future aviation system. 

1.2. 3.1 Sample Scenarios 

Given the importance of coordination among multiple agents in future ATM 
systems, scenario design was based on factors that pose challenges to such 
coordination within the system (see reports nos. 2 and 4). Some of these scenarios 
are derived from field observations, structured interviews and focus groups 
conducted as part of previous FAA and NASA funded research on the impact of the 
National Route Program (Smith, McCoy, Orasanu, et al., 1995). These particular 
scenarios focus on the impact of giving the airlines more flexibility in flight 
planning so that their business concerns can be better addressed. Other scenarios 
focus on components of a hypothetical free flight system, incorporating issues raised 
by the previous work of Sarter and Woods (1995) and Billings (1996) dealing with 
the impact of cockpit automation and air-to-ground communication technologies 
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on performance (see also report no. 7 in this volume). They involve operations in 
which a mix of free flight and controlled aircraft coexist, as is likely to be the case 
during the transition from the present to a future system. 

1.2.4 Using These Tools To Evaluate System Designs 

We have used the initial scenario set as the basis for several kinds of investigations 
to explore the potential impact of new ATM technologies on individual 
performance and on the coordination among multiple parties in the ATM system. 
The scenario set can eventually support more in-depth methods such as full or part 
scope simulation techniques as the AATT program matures. 

1.2. 4.1 Scenario-driven knowledge elicitation using subject-matter experts 

We have used our scenarios to structure interviews with subject-matter experts, 
either singly or in a group. These subjects have been asked to comment on the 
likelihood of certain events given alternative future system designs, to predict the 
effects of such events on their operations, and to discuss ways in which they would 
avert the occurrence of such events or compensate for them if they did occur. 
Several scenarios have been explored (and refined) using this approach. (See report 
no. 3 in this volume.) 

1.2. 4.2 Conceptual walkthroughs using "future incident reports" 

Scenarios have also been used as the basis for "incident reports" in which a future 
incident is predicted, and is presented in the form of a formal report investigating 
that incident (see report no. 4 in this volume). These incident reports, with 
supporting documentation, are presented to participants to consider as if they had 
actually occurred in some future system. The technique is used to structure a 
conceptual walkthrough by the participants, eliciting the ways in which the 
incidents might have been avoided, and how the system might be insulated against 
such occurrences or their effects. We have used this method to study how 
cooperative problem-solving in a hypothetical system can be facilitated, and how 
roles, responsibilities, procedures, policies and technologies must be designed to 
enhance performance and to make the system as error-tolerant as possible. 

1.2. 4. 3 "Role-playing" conceptual walkthroughs 

Another scenario was constructed to permit the observation of cooperative 
problem-solving more directly (see report no. 5 in this volume). Using this 
method, subjects are given the background and context of a scenario and the rules 
under which the system is operating. They are presented with the onset of an event 
and are asked to "play out" the scenario as it occurs, using a gaming board that 
represents the aircraft in particular ATC sectors. The participants can manipulate 
the gaming board to play out how the situation could evolve given different 
contingencies, actions, and interventions. Participants debate among themselves 
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different strategies for handling the situation. The methods by which they jointly 
resolve the problem are the data of interest. 

Our research to date indicates that the use of these methods, based on concrete 
scenarios depicting incidents in hypothetical worlds, is a very effective approach for 
identifying critical issues that need to be addressed in considering specific design 
proposals. 

Recommendation 3: As new designs (technologies, procedures, etc.) are 

proposed as part of the AATT Program, these three empirical methods 
should be applied early in the development process to assess the viability of 
each such proposal, and to identify the critical issues that must be addressed 
prior to its implementation. 


1.3 Findings 

We have applied the methods described above, working with a total of 40 
controllers, dispatchers, pilots and traffic managers. Based on our studies, several 
recommendations have been developed about where to focus future research and 
development activities. These recommendations are outlined below. Note that our 
investigations to date have dealt primarily with situations that will challenge 
performance under future system designs from a safety and efficiency perspective. 

1.3.1 Conflicting Goals and Capacity Constraints: Crossing Traffic 

New ATM concepts shift authority and responsibility across different organizations. 
In particular, many of the ATM concepts currently being discussed decentralize and 
distribute authority for many decisions such as the planning and rerouting of 
flights. This decentralization creates the potential for cases in which the goals of 
different participants in the ATM system interact or conflict, and the requirement 
and opportunity to resolve the conflicts by negotiation. (See reports nos. 3 and 4 for 
detailed discussion of these issues.) 

One such example that has already arisen as a result of the expanded NRP involves 
crossing traffic around major airports. A classic example of this arises with flights 
from Southern Florida to Minneapolis. With the introduction of the expanded 
NRP, the airline involved started filing such flights over Badger instead of over 
Iowa City-Waterloo. This put those flights in the departure lanes for traffic leaving 
Chicago O'Hare. 

In the short run, the solution selected was to deny requests for this user preferred 
route, or to vector such flights around the area once airborne. The net result was a 
significant loss of efficiency for the impacted airline. In this case, work with 
controllers and traffic managers suggests that the limiting factor is controller 
workload. Solutions to eliminate this bottleneck must consider how to redefine 
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sectors to reduce workload, how to provide tools that enhance controller capabilities 
(again reducing workload), or how to redefine the rules for the use of such airspace. 

A similar situation arose involving East-West traffic over Chicago. Under the 
expanded NRP, airlines started filing flight plans for this traffic over arrival and 
departure lanes. To resolve this problem, Chicago Center created new high altitude 
sectors. However, because there truly was a capacity limitation, in order to leave the 
NRP traffic untouched, arrivals and departures had to be restricted to lower than 
desired altitudes. The result is that fuel is saved by the overflights, but extra fuel is 
burned by arrivals and departures. 

The significance of such examples to the AATT Program is twofold. First, the 
airlines are already telling us by their actions where some of the important 
bottlenecks are that will need to be addressed by improved technologies or 
procedures. Second, such examples are a reminder that the aviation system 
includes competition for limited resources by users, and that there will continue to 
be a need for procedures whereby some "referee" decides what is "fair" or what is 
best for overall system safety and performance. 

Recommendation 4; Identify the types of situations where user preferences 
are likely to result in complex traffic patterns with crossing traffic, and explore 
solutions to eliminate the underlying causes of these bottlenecks. In 
addition, develop procedures to ensure safe, efficient, equitable handling of 
situations where such bottlenecks have not yet been successfully eliminated. 

1.3.2 Conflicting Goals and Capacity Constraints: Comerpost Loadings 

Another capacity limiting situation involves the overloading of cornerposts at an 
airport. An example of this is the northwest cornerpost at DFW during peak hours. 
In the short run, providing AOCs with predicted loadings could help them to plan 
more effectively, avoiding expensive reroutings due to such overloading. In the 
long run, however, it would be preferable to eliminate the capacity limitation. 
Unlike the Chicago example above, though, enhancing controller performance (in 
this case using tools like CTAS) only partially deals with the problem. Although 
capacity can be increased with such tools, another limiting factor then comes into 
play: runway availability. 

Recommendation 5: Explore solutions that minimize inefficient routings or 
vectoring to reduce cornerpost loading problems. Examine solutions that 
eliminate the underlying capacity constraints, as well as examining new 
decision support systems that make the most efficient use of the available 
capacity. (As one example, consider adding a "strategic" component to CTAS 
for earlier prediction and resolution of cornerpost loadings.) 

Our data suggest that situations involving conflicting goals and capacity constraints 
represent a very important class of problems. It is important to identify the full 
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range of situations where conflicts like these can arise and to explore alternative 
solutions. Many of these solutions involve questions about how to support 
communication and coordination across different parts of the ATM system. Our 
data also suggest that these are quite challenging problems because they involve 
multiple parties and multiple goals. 

1.3.3 Changing Roles and Information Requirements 

Changing roles by redistributing authority (locus of control) has strong implications 
for the kinds of information and information displays needed to support these new 
roles (see report no. 4). New ATM concepts change the roles of many of the people 
involved in the system. Under some current proposals, dispatchers will have more 
flexibility in route planning; flight crews will play a greater role in ensuring 
separation; and controllers will act more as monitors, making new kinds of 
decisions about when to intervene. If the role changes created by these shifts in the 
locus of control, and in decisions concerning whether and when to intervene, are 
not accompanied by a corresponding shift in access to information, problems will 
arise. 

7 .3.3.1 Airlines and Flight Planning 

A major problem in current operations is that the ATM system often has no access 
to information about the impact of its decisions on airline business concerns. As a 
result of this separation of authority and information, many decisions made by 
traffic managers and controllers are based solely on considerations regarding traffic 
flows and separation. Even when two solutions to a traffic problem are equally 
acceptable in terms of safety and traffic flow management, FAA staff generally do 
not have the information necessary to select a solution that might be preferable to 
an airline in terms of its business concerns. 

As a response to such problems, the FAA has been shifting the locus of control to 
the airlines where possible. One example is with the expanded NRP, where (subject 
to certain constraints) the airlines are now allowed to file the routes that they prefer. 
The assumption is that, since the airlines have the information about their business 
needs, they are in a better position to make such decisions. On the other hand, 
although the airlines have information about their own business priorities, they 
have only limited information about air traffic bottlenecks. As a result, they must 
also make decisions based on inadequate information. As several airline air traffic 
coordinators and dispatchers have commented in our studies: 

• "Under the expanded NRP, it's like shooting ducks in the dark." 

• "The problem with the expanded NRP is that there's no feedback to the 
AOCs. Nobody's getting smarter. Someone has to be responsible for 
identifying and communicating constraints and bottlenecks." 

• "It used to be that weather was the biggest source of uncertainty for flight 
planning. Now it's the air traffic system." 
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Thus, whoever is given the authority to make strategic decisions about routing 
flights needs access to all of the pertinent information. The implication is that, 
when exploring future designs for the aviation system, one of the most important 
questions to be considered is how to effectively distribute and represent the 
information needed to support decisions. 

7 .3.3.2 Flight Crews and Separation 

This same general issue arises in a tactical setting because of proposals to give flight 
crews more authority to change routes and altitudes while enroute. How do 
changing roles for flight crews and controllers affect who should have access to what 
types of information for tactical air traffic control decisions? 

If pilots are sometimes to be given responsibility for maintaining separation in a 
free flight environment, then they and any available support software will have to 
play part of the role that controllers currently play (keeping in mind that, under 
current proposals, controllers will at a minimum still be monitoring the situation). 
They will have to detect potential confliction points in a timely fashion, generate 
solutions, and coordinate their actions with other aircraft. 

Various studies of controllers indicate that they consider a number of complex 
factors including weather, the intentions of other aircraft, available contingencies, 
and positional uncertainty. In addition to considering the implications of these 
factors for their own flight, this new environment will require pilots to think about 
these factors as they impact other aircraft. New patterns of communication will also 
be required, as there will no longer be a single authority approving route and 
altitude changes (see report no. 7 in this volume). Furthermore, pilots will often 
have less knowledge than controllers do about typical traffic patterns in particular 
sectors, potentially making the cognitive demands on flight crews even greater. 

Thus, our research has raised provocative questions about the roles of flight crews, 
controllers and support software in such an enroute free flight environment. It is 
clear that careful consideration must be given about who should have access to 
what information, about how wide a "field of view" each participant should have, 
and about how this information should be conveyed. 

7 .3.3.3 Controllers as Exception Handlers 

Some of the new ATM concepts currently being considered suggest that in certain 
circumstances, controllers will act as monitors, detecting problems and intervening 
only as necessary to resolve specific concerns. The new roles have considerable 
implications for how controllers obtain the information they will need to carry out 
this role. Examples of controller statements during our studies help illustrate the 
complex issues that must be considered in proposing future system designs: 
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• "In adverse weather, communication occurs between controller and flight 
crews as needed. We ask: 'When are you going to turn?' and they say: 'I 
can't because weather is there.' In that case I need to do something with 
someone else. If I can get him out of the way, I do it. The decision and 
evaluation process is 10 to 20 fold more complex as no structured game plan 
exists. It constantly changes as their needs change in each mile they go." 

• "For me to have the big picture or overview I need to know intent. Not 
knowing where the path is can be a problem. If I change your true path and 
another plane turns quickly, then we're back into trouble." 

• "In free flight, nothing is preset. You will have to scan all the time. In the 
current system [there are] confliction points where [you expect] flows to cross 
on a daily basis. They are the spots you concern yourself with. You focus on 
confliction points. But in a free flight environment, everything is a focus 
point." 

There are many tasks and situations that must be dealt with to enable enroute free 
flight in situations involving multiple aircraft or unpredictable weather patterns. It 
is clear that such complex factors cannot be adequately handled by an autonomous 
machine agent in the foreseeable future, therefore any tools developed must be 
explicitly designed to support and enhance decision making by flight crews and 
controllers. 

Recommendation 6: Identify the information and decision making 
requirements associated with new roles within proposed new ATM concepts. 
One tool for doing this is scenario-based walkthroughs that increase in level 
and scope of fidelity as the AATT project matures. The results will be 
important input for the development of new technologies as true decision 
support systems. 

1.3.4 Coordination During Transitions in Level or Locus of Control 

Another desired attribute of many proposed concepts for future ATM is flexibility 
Under these proposals, flight paths and plans should be adjusted dynamically to best 
meet the rapidly chang in g demands and circumstances of the air traffic 
environment. ATC should intervene only when circumstances demand; otherwise 
individual operators should be able to plan flights and manage flight paths as they 
see fit based on their perspectives and goals. 

This flexibility creates demands for coordination in several ways. Flight crews and 
ground controllers will have joint responsibility for positive separation. Locus of 
control will shift as circumstances demand. For example, traffic density in terminal 
areas will require transitions from free flight rules to greater control by ATC. How 
will these transitions be made smoothly? A major challenge for a more flexible and 
less centralized traffic management environment is the need to handle transitions 
in locus or level of control in order to cope with highly dynamic and unpredictable 
factors such as weather, emergencies and system failures. How will operators 
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recognize when circumstances create the need to shift locus of control? How will 
people communicate the change in management strategy and transition to a new 
form of control? Are there intermediate levels between full ATC control and full 
enroute free flight? 

Our scenarios include situations where the locus or level of control must change in 
order to accommodate an event or environmental condition, thus allowing us to 
explore issues in successful coordination and cooperative problem-solving. Such 
transitions require highly effective coordination and communication between 
different people in the system and different computer based support systems. We 
also included a variety of elements that complicated communication and 
coordination, using these elements as probes to trigger discussion among the 
participants in the meeting about how to avoid or cope with such problems by 
means of new procedures, technologies or protocols. 

1. 3.4.1 Paradigms for Distributed Control 

There is a variety of paradigms for distributing control. It is useful to consider three 
distinct paradigms as anchor points for exploring possible strategies in ATM. An 
actual system is likely to be based on intermediate strategies or a mixture of these. 
The first is "control by directive", where an agent in the ATM system (a controller, 
for example) simply issues an instruction which is to be followed (unless there is' 
some overriding concern that prevents this). The second is "control by 
permission", in which the ATM system initially specifies a solution, but will 
consider and sometimes give assent to requests for alternatives submitted by system 
users. A third is "control by exception", in which system users are allowed to select 
and act on their own solutions or plans, which are then monitored by the ATM 
system for potential problems as these plans are enacted (see report no. 5 in this 
volume). 


Within these paradigms there are a number of important variations that need to be 
carefully considered. For example, one extreme version of "control by exception" is 
to restrict interventions to localized, reactive responses by the ATM system. Under 
this variation, the ATM system would leave flights alone until and unless serious 
safety or system capacity problems were imminent. The assumption is that the 
users would generally select plans that avoided such situations so that 
interventions by the ATM system would be infrequent; it would function only as a 
backup safety net. Under another variation, the ATM system might play a more 
proactive role, dynamically setting certain constraints and communicating these 
constraints for the users to consider when they are comparing alternative plans. A 
third alternative would be for the ATM system to communicate a constraint by 
listing an explicit set of options for selection by the user. A fourth would be true 
collaborative control, where the users and the ATM system jointly assess the 
situation and consider alternatives. Numerous human factors issues arise in 
considering these alternatives: 
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• How do we ensure adequate involvement of various participants so that they 
maintain situation awareness, including continuous awareness of who is in 
control? 

• How do we ensure adequate training and involvement of various participants so 
that they develop, and equally important, maintain the necessary skills? 

• How can technology support the individual performance of controllers, 
dispatchers, pilots and traffic managers (assessing situations and monitoring for 
problems; generating and selecting from alternative solutions)? 

• How will workload be predicted and managed given greater variability in the 
behavior of the system? 

• In situations where there are goal conflicts, how do we ensure that adequate 
"refereeing" occurs (especially if the conflict has safety implications)? 

• What types of roles should be assigned to participants so that, where appropriate, 
effective cooperative problem-solving will occur? 

• How do we ensure that adequate mutual understanding develops regarding each 
participant's goals, capabilities and constraints? 

• How can new technologies support the communication of intent under both 
normal and contingency conditions? 

• What types of tools should be developed to support cooperative work (e.g., tools 
to enhance a shared model or common ground; tools for graphic 
communication)? 

The conceptual walkthroughs we have conducted provide results pertinent to these 
questions (see reports 4 and 5 in this volume). For example, the rules defining an 
operational error for violation of minimum separation standards will have an 
impact on when controllers will consider it necessary to assert more positive control 
on the aircraft they are monitoring. In regard to this issue, one of the controllers we 
studied indicated that if controllers were charged with operational errors when 
there was a violation of separation standards between aircraft operating under free 
flight rules, then controllers will not be able to wait for individual airplanes to sort 
out situations. Controllers will intervene and take control before such situations 
develop, rather than trusting flight crews to find resolutions on their own. 

Although our research on coordination during transitions in the level or locus of 
control has begun to identify some of the factors that should be taken into account 
and to suggest some initial solutions, much work remains to be done to understand 
the impact of alternative control paradigms on individual performance, as well as 
on cooperative and (in some cases) competitive group performance. 

Recommendation 7: Coordinated activity and cooperative problem-solving 
will be fundamental requirements in the implementation of the new ATM 
concepts currently under consideration. The AATT program needs to assess 
the potential impact of alternative methods of control and coordination on 
individual, group and overall system performance and to explore the design 
of tools for computer-supported cooperative work. 
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1.3. 4.2 Communication Requirements During Transitions in Locus of Control 

An environment in which pilots and controllers have joint or overlapping 
responsibility raises important issues about communication. For example, there is 
the potential for one party to act without adequate prior communication. 
Knowledge of intent may be difficult to maintain in these circumstances, yet 
knowledge of intent may be the critical information needed to anticipate potential 
problems. How will controllers monitor for potential problems if they cannot 
assume that they know the intentions of the aircraft they are monitoring? Thus, 
information on pilots and controllers' intentions, decisions, and actions needs to be 
gathered and distributed very quickly to ensure that all affected parties are aware of 
changes in a timely fashion. (See reports nos. 7 and 8 in this volume.) 

Similarly, once controllers recognize the need for intervention, how will they 
communicate this to all affected aircraft, providing assistance or asserting positive 
control over these aircraft and then returning them to free flight after the problem 
has been resolved? The pilots and controllers who participated in our studies agreed 
that successfully handling such situations in the future ATM system will require 
context-dependent, flexible and operator-controlled selection of communication 
media, protocols and strategies, while recognizing concerns about potential new 
demands on visual attention imposed by the introduction of additional displays. 

Given the many competing demands for visual attention that already exist for both 
pilots and controllers, it will be critical to provide them with "big picture", status-at- 
a-glance displays that allow for parallel processing of various kinds of information. 
For example, the transition from enroute free flight to a more controlled 
environment potentially requires message acknowledgments by a large number of 
affected crews. These acknowledgments cannot be handled solely via voice 
communication as the controller may have to use the voice channel for issuing 
urgent clearances. Most controllers consider Data Link the medium of choice for 
those acknowledgments. But the implementation of digital communication for this 
purpose could create user problems. For example, users did not want to have to 
keep track of acknowledgments by referring to and monitoring a separate 
chronological message list. One possible solution proposed by some controllers is to 
visually code affected radar targets and their data blocks to indicate whether an 
acknowledgment has been received by the Data Link system. The goal would be to 
indicate acknowledgment in a way that would support pattern recognition. 

In summary, communication demands, procedures, and technologies in the context 
of future highly flexible ATM operations are likely to differ considerably from those 
in the current highly standardized and more centralized ATC system. More insight 
is needed into the likely effects of introducing digital communication on the 
coordination between and among ground-based and airborne operators. 
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Recommendation 8: Examine scenarios involving transitions in method or 
locus of control to help assess the design of communications technologies 
and procedures. Specifically, the design of protocols and interfaces for a 
digital communication system needs to be reviewed and adapted to future 
ATM operations, since designs have been driven for the most part by the 
demands and characteristics of the current ATC system. One important goal 
is to avoid overloading visual attention during demanding situations and to 
enhance system transparency so that users can focus on what and to whom 
they want to communicate rather than focusing on the interface codes and 
commands needed to monitor and send messages. 

Recommendation 9: Evaluate the potential for graphic communication tools 
for pilot-controller communications to coordinate interactions concerned 
with short-term flight plan modifications, weather phenomena and other 
potential hazards. Shared graphic tools are examples of computer-mediated 
cooperative work tools that could support transitions in locus of control, 
enhance shared situation awareness among flight crew, controllers and 
others, and support new controller roles to monitor and intervene only 
when needed. 

1.3.5 Additional Specific Recommendations 

Recommendations 4-9 deal with specific areas of concern that have been identified 
in our research, including issues dealing with conflicting goals and capacity 
constraints, changing roles and information requirements, coordination during 
transitions in the level or locus of control, and communication requirements 
during transitions in the locus of control. Several other specific recommendations 
arise from the interactions of these categories of issues. They are listed below. 

Recommendation 10: Based on the scenarios studied to date, we recommend 
research on the human factors implications of a number of technologies: 

a) To support pre-flight planning by AOCs, predictive tools need to be 
developed to collect, analyze, disseminate and display air traffic bottleneck 
forecasts (analogous to weather forecasts) and to support plan generation. 
Even with the introduction of the expanded NRP, this is a major request by 
dispatchers. ("What we really need to make good decisions is NRP forecasts 
to help us decide where traffic congestion is likely to cost us time or fuel.") 

b) To support tactical planning while a flight is enroute, similar tools need to 
be developed to help pilots and dispatchers detect and deal with traffic and 
weather conflicts. Such tools would support the flight crew and dispatcher in 
considering complex factors such as the intentions of other aircraft and the 
availability of alternatives to deal with possible events. (A major question in 
designing these tools is how to provide an adequate field of view to support 
the detection and evaluation of developing situations.) 
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c) Tools need to be developed to provide information about the availability of 
special use airspace to support both strategic and tactical planning by flight 
crews and AOCs. 

d) Tools need to be designed to provide controllers with information needed 
to monitor for potential problems, so that the controller can intervene in a 
timely fashion to help avert a potential loss of separation or provide advice 
on how to deal with a developing situation. This includes information about 
the intentions of flights. (The need to display intent may call for changes in 
aircraft flight management systems as well.) 

e) Some situations will be too complex to allow enroute free flight. Tools 
must be designed to display the information necessary to help controllers and 
traffic managers predict and detect such situations, and to communicate to 
AOCs and flight crews those sectors that have been permanently or 
temporarily designated as "controlled" or non-free flight areas. (This is 
similar to issues currently faced in dealing with special use airspace.) 

f) All of the above tools would help controllers, dispatchers, pilots, and traffic 
managers to deal with real-time problems as they are developing. Equally 
important are tools that provide feedback on performance. Tools need to be 
developed to help assess the success or failure of the strategies that various 
parties are applying, so that they can learn and improve. 

Finally, there are several areas where current ATM procedures need careful 
investigation, looking for opportunities to provide the airlines with greater 
flexibility to accommodate their business needs. To make these feasible, it is likely 
that additional tools for computer-supported cooperative work need to be 
developed and studied. 

Recommendation 11: Develop tools to support, and study the impact of, new 
ATM procedures that give the airlines more flexibility to deal with their 
business concerns, while ensuring safe and effective overall use of system 
capacity. Such procedures should deal with concerns about ground delay 
programs, severe weather routes, slot-swapping and runway assignments. 

1.3.6 Other Conclusions and Recommendations 

1.3. 6.1 Training and Skill 

The implementation of the expanded National Route Program has given rise to 
numerous misconceptions on the part of flight crew as to the purposes, policies, and 
procedures permitted or required under that program. (See pp. 3-8 and 3-9, page 3-17 
and Observation 9 in report no. 3 in this volume.) These misunderstandings must 
remind us of the critical importance of training in a rapidly-changing environment. 
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Training will become even more important as further changes are implemented in 
the future aviation system. A lack of knowledge on the part of any class of 
participants can negate the gains in productivity or efficiency that such a change is 
intended to bring about, as shown in observations reported by our participants. 

The misunderstandings reported here must also serve as reminders that training 
must be considered in the design of the future system. More distributed decision- 
making in the future system will require new procedures to ensure that all 
participants understand precisely how to determine who is in control of what, and 
how that control may be transferred among participants. This will involve new 
procedures which must be learned and understood. If pilots are to assume 
responsibilities for separation now exclusively the province of controllers, they will 
also have to learn what information is required, and how to use that information in 
making new decisions about flight path management. 

Finally, controllers may find themselves managing the ATM system by exception 
(see report no. 5 in this volume), a role quite different from their accustomed role in 
the present system. This may also require the acquisition of new skills. It will 
certainly require that steps be taken to ensure their continued proficiency as 
controllers, though they may be actively controlling traffic much less than at 
present. The likelihood of skill decrements is real if controllers become less actively 
involved in traffic control and management. 

Recommendation 12: ATM system designers must keep the training needs of 
controllers, pilots, dispatchers and traffic managers prominently in mind as 
they conceptualize and design the future ATM system. Guidance with respect 
to this issue will be required and should be a part of design requirements for 
the future system. Research like that reported here can be of help in 
developing training requirements for the future system. 

13.6.2 Sharing of Information 

A pervasive issue raised by the experts who took part in this study is the need for 
more information, more widely distributed, in a system in which decision-making 
is widely distributed. This issue was raised in every study conducted in this series. 
Exactly what information is required, and how it is to be represented to system 
participants under what circumstances, to permit wider distribution of decision 
authority, is less clear, yet answers to these questions will be crucial to effective 
system design. The scenarios used in these studies have illuminated some of the 
questions, but research will be required to obtain answers, and thus new system 
requirements. 

Recommendation 13: The AATT program should maintain a focus on 
research into information management and information requirements as it 
maps out the architecture of the future system. Some of the information 
requirements for decision-making regarding flight path control will be 
difficult to mechanize, and these will require particular attention by program 
managers . 
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1.3. 6. 3 Philosophy, Policies and Procedures in the Future System 

The architecture of the future ATM system is still unclear in many respects; that is 
the reason for the AATT program. Yet the design of the future system cannot be 
effective unless policy and procedural guidance is a part of the input to the design 
process. These studies point out how critical an understanding of participant needs 
is to formulation of design requirements for the future system. This complex, 
highly distributed system can only be effective if its architectural requirements are 
the drivers for the technological innovations that will be required in its realization. 

Recommendation 14: The AATT program should work toward providing 
high-level conceptual goals, an operating philosophy, and a set of policies as 
guidance for designers of the future ATM system and of its components. It 
should sponsor further research specifically targeted at the development of a 
candidate philosophy, policies and possible procedures for the future system, 
in order to make the development process as coherent as possible. 

1.4. Summary 

The purpose of this report is to provide an indication of the conclusions we have 
reached based on our empirical studies under the AATT Program. Some of these 
recommendations are preliminary and incomplete. As we continue our data 
analyses, they will be refined, and new ones identified. 

Generally speaking, our major theme is that it is important to evaluate new 
technologies early in the design process, and to do so in terms of the broader context 
of coordination and cooperation among the multiple agents within the aviation 
system. In conducting such evaluations, there are a number of factors that need to 
be considered, including: 

• The constraints of the physical and operational environments; 

• Philosophy, policies and procedures under which the system will be operated; 

• Information that needs to be made available to various participants; 

• Methods and technologies for distributing this information; 

• Methods and technologies for supporting individual performance; 

• Methods and technologies for supporting effective distributed, cooperative 
problem-solving. 

Finally, it is critically important that we understand how different support 
technologies will influence human performance in the context of different 
situations or scenarios, especially scenarios where significant capacity constraints 
must be dealt with, and scenarios where transitions in the locus of control must be 
handled. 
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2.1 Discovering Requirements for Future Systems 
2.1.1 The Problem Of Envisioned Worlds 

One important question for the AATT program is methodological: How can we 
identify system requirements for new ATM concepts and technologies, recognizing 
the potential for these changes to create new roles and procedures for individual 
participants, new forms of coordination across personnel and organizations, and 
new types of information to communicate, assess and integrate. 

Developing functional requirements for human roles and support systems for such 
an envisioned world is difficult, in part, because the system of interest does not yet 
exist. There are no prototypes or mock-ups, and no practitioners who work in the 
future world. Usability testing is impossible: there is nothing to do it on and nobody 
to do it with. Yet, analyzing some of the cognitive ramifications and error 
opportunities in a future environment before any commitments to particular 
system designs are made is a tantalizing and potentially very fruitful prospect. How, 
then, can we can gain access to a world that does not yet exist? How can an 
envisioned world be a source of data on the cognitive demands it imposes and the 
error and failure potential it creates? 
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The methodological problem is further complicated because different parties may 
have different visions of how the future world will work and because many details 
of the future system design are underspecified. 

As an envisioned world, different developers, stakeholders and decision makers are 
each likely to develop their own insights and views on how the whole ATM system 
will work in the future. These visions can vary in perspective and degree of detail, 
since different stakeholders view the future world from different angles based on 
their role in the current system. In addition, stakeholders' views may be based on 
what they perceive to be the potential impact of the future world, as different groups 
of practitioners will have different stakes in what the future world will, or must, 
have in store for them, their positions, influence, job security, status, or roles. 

As a result, at the early stages of conceptual development, there is (and must be) a 
diverse and loosely coupled collection of visions for the future. We refer to this 
aspect of the envisioned world problem as PLURALITY. Plurality means that there 
are many views that partially describe the future world. Since each comes from only 
the single perception of one group of practitioners or stakeholders, these views are 
necessarily partial representations of the ultimate complete and functioning system. 
Thus, to develop a coherent and complete set of functional requirements for human 
roles and support systems for an envisioned world one must integrate and 
rigorously explore all of the implications of these different viewpoints. 

By definition, at an early stage of concept development many if not most details of 
the future system design are underspecified. The fact that developers are not bound 
by concrete, tangible roles, policies, and support systems can produce gaps and 
simplifications relative to the cognitive and cooperative work required of people in 
an envisioned ATM system. UNDERSPECIFICATION means that each of these single 
views is in itself a simplification, or partial representation of what it will mean for 
people to practice or carry out different roles when that envisioned world becomes 
concrete. 

The fundamental underspecification that must exist in the early stages of a 
development process makes it easy for stakeholders to oversimplify the impact of a 
proposed concept on the roles, decisions, coordination needs, and information 
requirements of the people involved in ATM system. 

These characteristics- 

• an underspecified system concept, 

• diverse but partial views of how the envisioned world might work, 

• the potential to oversimplify the impact of design decisions on people's roles, 
responsibilities, and activities, 

create the difficult methodological challenge that is the envisioned world problem. 
How do we design and test these new roles before committing large pools of 
resources? How can we assess the impact of new ATM concepts and technologies on 
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the individual and collective performances of controllers, dispatchers, flight crews 
and traffic managers? In other words, we need a model method to quickly prototype 
and study how people and technologies will coordinate in realistic operational 
scenarios for different ATM concepts. 

Figure 2-1 illustrates a range of techniques available to us to investigate possible 
characteristics and design choices for the future ATM system. Two high level 
dimensions define the space of techniques. One refers to degree of control. The 
other refers to a correlated set of concepts of face validity, behavioral complexity, 
environmental richness (what is often referred to as real world fidelity or ecological 
validity). This space of methods was deliberately laid out to reveal a basic tradeoff: 
methods that are high on both dimensions in the figure can only be deployed 
relatively late in the development process, and they tend to be resource intensive. 
How do we generate the needed information to support decisions about the 
development of new ATM concepts and technologies in a cost-effective and timely 
manner? 



Figure 2-1: Potential research approaches. Methods high on both dimensions are resource 
intensive and generally become available relatively late in the development process. 

2.1.2 Tools To Investigate Envisioned Worlds 

To discover requirements for a future world, one needs to consider the appropriate 
mix and timing for using these different methods. In our work we have been using 
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methods that balance cost, timeliness, degree of control, face validity and 
environmental richness to provide useful input to system developers early in the 
design process. The methods that we have been exploring to support requirement 
identification for the ATM case are: 

• empirical-collecting data about how people may carry out new roles and utilize 
possible new systems, thus helping to identify potential problems and define 
requirements for system development. 

• scenario driven-rigorously exploring the implications of new ATM concepts and 
technologies by having different kinds of expert practitioners explore them in the 
context of concrete situations. 

• iterative and converging-using multiple approaches that build on each other 
and converge on results that can support design decisions. 

We have used three basic approaches to begin to develop human-centered 
requirements for future ATM concepts. 

• Knowledge Elicitation: Scenario-driven knowledge elicitation using subject- 

matter experts. 

One method that we have applied is to use scenarios to structure interviews with 
subject-matter experts, either singly or in a group. These subjects have been 
asked to comment on the likelihood of certain events occurring given 
alternative future system designs, to predict the effects of such events on their 
operations, and to discuss ways in which they would avert the occurrence of such 
events or compensate for them if they did occur. In applying this method, an 
effort is made to utilize subjects from different specialties, in order to elicit their 
different perspectives. Several scenarios have been explored (and refined) using 
this approach. 

• Future Incident Technique: Conceptual walkthroughs using future "incident 
reports". 

Scenarios have also been used as the basis for "incident reports" in which a 
future incident is predicted and is presented in the form of a formal report 
investigating that incident. These incident reports, with supporting 
documentation, are presented to participants (we have used groups of air traffic 
controllers, dispatchers and pilots) to consider as if they had actually occurred in 
a future system. The technique is used to structure a conceptual walkthrough by 
the participants, eliciting the ways in which the incidents might have been 
avoided and how the system might be insulated against such occurrences or their 
effects. We have used this method to study how cooperative problem-solving in 
a hypothetical system can be facilitated, and how roles, responsibilities, 
procedures, policies and technologies must be designed to enhance performance 
and to make the system as error-tolerant as possible. 

• Cognitive Walkthroughs: "Role-playing" conceptual walkthroughs. 

Scenarios were also used to observe cooperative problem-solving more directly. 
Using this method, subjects are given the background and context of a scenario 
and the rules under which the ATM system is operating. They are presented 


2-4 



with the onset of an event and are then asked to "play out" the scenario as it 
occurs. The role playing is supported by a gaming board that represents the 
aircraft in particular ATC sectors. Participants can manipulate the gaming board 
to play out how the situation could evolve given different contingencies, actions, 
and interventions. Multiple participants debate among themselves different 
strategies for handling the situation. The methods by which they jointly resolve 
the problem are the data of interest. We believe this approach has considerable 
potential as a second method to conduct a conceptual walkthrough, eliciting 
additional insights concerning how various human and machine elements 
would interact in some future system. 

Our research to date indicates that the use of these methods, based on concrete 
scenarios depicting incidents in hypothetical worlds, is a very effective approach for 
identifying critical issues that need to be addressed in considering design concepts 
and proposals. 

2.1.3 Conceptual Walkthroughs 

All of these techniques are based on CONCEPTUAL WALKTHROUGHS in different ways 
and to varying degrees. In these conceptual walkthroughs, we posit a future ATM 
system, or parts of it, through development of a concrete scenario that instantiates a 
situation within that future system. We collect data by asking a set of aviation 
practitioners with different areas of expertise to evaluate or play out potential roles 
and interactions under that scenario, identifying how it could work and where it 
might be vulnerable. In effect we try to turn plurality to our advantage by bringing 
together different kinds of practitioners with different perspectives to confront very 
concrete problem-solving scenarios in possible future ATM worlds. This is 
intended to reveal disjunctions and gaps across the various perspectives and elicit 
the cognitive demands that practitioners would confront during problem-solving 
situations in the envisioned world. 

Critical to this method is the use of concrete scenarios to anchor participants to the 
coordination, communication, decision making and knowledge exchange functions 
necessary to handle the situation successfully. Rather than providing yet another 
(potentially underspecified) demonstration of how the future world would 
function, the scenarios are designed to challenge future architectures, to push on 
places where they may be vulnerable or to show how they may break down. Thus, 
the scenarios invite practitioners to think critically about the requirements for 
effective problem-solving in the envisioned world. 

The conceptual walkthroughs, as a technique to cope with the envisioned world 
problem, sees today's practitioners (pilots, controllers, dispatchers, air traffic 
managers) as a valuable source of expertise on solving problems in the airspace 
domain. Different kinds of practitioners bring different stakes and different 
problem-solving perspectives. Of course, when it comes to using their expertise to 
solve future problems, today's practitioners are familiar with the role they play 
today and not with the role they may have to play in the future system. A pilot, for 
example, may have difficulty assuming responsibility for separation in his new free 
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flight role, just as a controller may have reservations about relinquishing separation 
authority. The key is not to rely on the participants' opinions about the future, but 
to use the scenarios to help them reveal the constraints that will need to be met to 
make a future system work well in terms of cognitive and cooperative activities. 

The value of the conceptual walkthrough depends on the construction of effective 
scenarios. Concrete, challenging scenarios serve as a mechanism to explore the 
dynamic interplay of cognitive activities and demands associated with different 
problems that can occur and unfold in the envisioned world. A good future 
incident provides a compelling demonstration of the cognitive work required to 
operate successfully with new roles and rules in the envisioned problem-solving 
environment. The scenarios then are not simply "interesting" cases, but represent 
an instantiation of factors that may play an important role in the future system. For 
example, the scenarios used in this work create concrete instances where a future 
ATM system must shift from one form of control to another (from less to more 
controlled air space). Another example is a specific case where different parties have 
different but conflicting goals (e.g., enroute traffic crossing a departing stream). 

To provide useful results relative to an envisioned world, the conceptual 
walkthroughs should involve a set of participants with different perspectives who 
can challenge each other's proposals if they are underspecified or if they are 
incompatible with the demands and goals of another part of the overall system. 
These disjoints occur naturally as diverse participants confront challenging cases, 
and help identify system requirements. 

We have used two strategies to confront expert practitioners with concrete problem- 
solving situations: the FUTURE INCIDENT TECHNIQUE and COGNITIVE 

WALKTHROUGHS of future problem-solving situations. The Future Incident 
Technique has practitioners provide a retrospective analysis of a reported incident 
that might occur in a future ATM world. The report describes an incident that has 
taken place one or two years from now (where now is 1996) in a possible future 
ATM system. The hypothetical reports forms shown on pages 21-23 show one such 
future incident report. Participating practitioners are asked to evaluate the report as 
neutral observers (Woods, Cook, Johannesen & Sarter, 1994), i.e., as domain experts 
who are not caught up in the evolving problem-solving context, but who can offer 
problem-solving strategies in comparison to those used by practitioners in the 
incident. 

In contrast, cognitive walkthroughs of future problem-solving situations provide 
participating practitioners with the initial conditions of a situation that have the 
potential to concatenate and evolve into an incident. Several different practitioners 
are invited to participate in solving future problems, under guidance of a researcher. 
The practitioners are seated around a representation of a piece of airspace, the "game 
board" (see Figure 2-2). The initial conditions of the problem are portrayed on a 
game board that represents a God's eye view of a piece of airspace with aircraft in it 
(not unlike the "shrimp boat" tables that were used prior to radar-based air traffic 
control; Nolan, 1994). 
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Figure 2-2: The set-up for the cognitive walkthroughs of future problem-solving situations. 

Aircraft on the game board are annotated (to display their call signs and altitudes) as 
they are on today's PVDs - with the exception of cleared altitudes since those will not 
be available in free flight. Practitioners are asked to take the initial conditions and to 
verbalize and discuss with one another the ways in which they want to solve the 
problems that could ensue from the initial conditions. Specific solution strategies 
(directives, clearances, airspace changes, etc.) can be marked on the game-board and 
are used as a trace of problem-solving behavior (see Figure 2-3). Additional probes 
(extra complicating factors, for instance) are inserted as the scenario unfolds. 

In the Future Incident Technique, practitioners are confronted by a near miss or 
failure. The fact that the system has not functioned completely successfully 
reframes the envisoning process. Instead of thinking about how a future concept 
might work, the participants are forced to consider how the system might break 
down. This can lead them to identify the cognitive and coordination demands that 
need to be supported to make the concept robust and successful in the real 
operational environment. The incident is worked out a priori, and in its entirety, 
including the outcome. Thus, participants discussion may be limited because they 
see a single path and have knowledge of an outcome. 
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Figure 2-3: The game board used during the cognitive walkthroughs of future problem solving 
situations; pilots and controllers are discussing and pointing to a particular problem. 

In contrast, during cognitive walkthroughs, practitioners are caught up in the 
evolving incident. The outcome is not known, not even to the investigator. Before 
the cognitive walkthrough, practitioners are prepared for their new roles and rules 
through briefings and handbook excerpts, etc. In addition, changing rules are 
instantiated as background characteristics or complicating factors (for example: 
aircraft will not necessarily exit free flight airspace neatly across one particular 
waypoint). Other complicating events and factors are inserted during the evolution 
and treatment of the incident (for example: a communications failure may occur, or 
a thunderstorm may crop up), in order to challenge and put pressure on particular 
rules or roles. 

These two approaches provide converging evidence about the roles, responsibilities, 
cooperative activity, judgments, communication and areas for support in a possible 
future world. 

2.1.4 Verbal reports of problem-solving strategies reveal differences that serve as a 
source of data on cognitive demands 

As different expert practitioners (pilots, controllers, dispatchers) assess concrete, 
detailed future problem-solving situations, the data of interest are the disjunctions 
and gaps among the individual interpretations and problem-solving strategies. The 
disjunctions between the various interpretations and perspectives often point to the 
demands and potential bottlenecks in a possible future ATM system. Data on these 
disjunctions consist of verbal reports on problem-solving during the incident 
scenarios (Ericsson & Simon, 1993; Woods, 1993) from audio recordings supple- 
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merited by video recording of the interactions with the gaming area for the 
cognitive walkthroughs. 

When confronted with other perspectives, however, the differences in problem- 
solving strategies and the disjoints in how practitioners perceive the envisioned 
system can reveal the following: 

• places where pieces of knowledge to solve a problem may be unavailable (e.g., a 
controller may want aircraft intent, but according to a pilot it may not be 
accessible given the nature of his operations at that moment); 

• times when different goals come into conflict (e.g., a dispatcher may want a pilot 
to use his free flight flexibility to go to a particular airport, but the pilot will 
divert somewhere else, or a controller may want a pilot to go through a weather 
system to solve one of his own problems, but the pilot will not do it); 

• situations in which attention must be distributed across different or very large 
portions of the problem-solving world (e.g., the controller may simply want to 
get a number of aircraft off free flight, but the flight crews will want to know the 
specific headings, altitudes, and speeds they should fly once taken off free flight). 

In the reports, these knowledge, strategic and attentional demands can be referred to 
by statements of how difficult it may be to accomplish a certain activity, but also by 
suggestions of strategies or system changes that would help attenuate this difficulty. 
Disjunctions not only reveal underspecification in individual interpretations, they 
also reveal hard constraints and problems that the future system will have to deal 
with. This means that if the different practitioners are able to reach consensus on 
resolution of the incident problems after the specifics of the future mishap have 
been brought to light and been battled over, then this can point to more robust 
suggestions for the design of better specified procedural or technological support. 

2.2 Scenarios 

Given the importance of coordination among multiple agents in future ATM 
systems, scenario design was based on factors that pose challenges to such 
coordination within the system. For example, we considered factors that create the 
need for timely communication and coordination between multiple agents, factors 
that create the need for updated situation assessments and decisions, and factors that 
lead to conflicting goals. 

Some of these scenarios are derived from field observations, structured interviews 
and focus groups conducted as part of previous FAA and NASA funded research on 
the impact of the National Route Program (NRP) as initially defined in Advisory 
Circular 90-91, and more recently modified under orders defining the expanded 
NRP (Smith, McCoy, Orasanu, et al., 1995). These particular scenarios focus on the 
impact of giving the airlines more flexibility in flight planning so that their business 
concerns can be better addressed. 
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The initial scenario set can be used to support many different activities. We have 
used them as the basis for several different kinds of investigations to explore the 
potential impact of new ATM technologies on individual performance and on the 
coordination among multiple parties in the ATM system. The scenario set can 
eventually support more in-depth methods such as full or part scope simulation 
techniques as the AATT program matures. 

2.2.1 Probes for Knowledge Elicitation 

2.2.7. 7 Basis for Scenarios and Observations 

The goal of this set of scenarios is to focus attention on preflight planning at the 
airlines, and on the implications of such planning for air traffic management and 
control, with an emphasis on human factors issues. This scenario set was used to 
begin to address the following questions: 

1. What rules and procedures should be adopted to govern the behaviors of the 
airlines and the Air Traffic Management (ATM) system during preflight planning 
activities? How will these rules and procedures deal with current concerns? Will 
they create any potential new concerns? 

2. What rules and procedures should be adopted to govern the behavior of air traffic 
(including military, general aviation and commercial aviation traffic) and the 
actions of traffic managers while flights are enroute in order to allow them to deal 
with situations that may arise as a result of the rules governing preflight planning? 

3. What roles and responsibilities should be assigned to different individuals at the 
airlines and within the ATM system? What training is necessary to ensure effective 
performance in these roles? 

4. What services should the ATM system provide to the airlines? 

5. What information should be exchanged between the ATM system and the 
airlines (both real-time and historical information)? 

6. What technologies need to be developed to effectively support these roles and 
responsibilities? 

The scenario set is based on some high level issues including 

• factors that lead to conflicting goals, 

• factors that create the need for updated situation assessments and decisions, 

• the dynamics of the airspace flows and capacities, 

• factors that create the need for cooperation across multiple interacting 
organizations and individuals, 

• the distribution of information across multiple interacting organizations and 
individuals in anticpating, detecting or responding to problems, 

• situations where feedback about results of policies and decisions is needed to 
ensure system and organizational goals are met. 
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The scenario set below is based on some high level issues such as goal conflicts, the 
dynamics of the airspace flows and capacities, strategic issues, cooperation across 
multiple interacting organizations and individuals, feedback about results of 
policies and decisions. (Detailed findings from experiments using this set of 
scenarios are discussed in report no. 3 in this volume.) 

2. 2. 1.2 Scenarios to Guide Knowledge Elicitation 
ATM Background 

To help make the discussion concrete, we are going to use the ATM system as it 
existed from January 9, 1995 to December 31, 1995 as our "scenario." The basic 
question is: What can we learn from experiences that arose during the initial 

implementation of the expanded NRP in order to guide us in future decisions about 
the design and implementation of the ATM system? 

The Scenario Set 

Observation 1. Data from one major airline indicated that the increased flexibility in 
flight planning provided during the first three months under the expanded NRP 
allowed its dispatchers to file flight plans with the potential to improve fuel 
efficiency by 2.5%. 

Observation 2. As stated by a TMO, 'The MAR program and the NRP program have 
been beneficial in a way. They have shown us a lot of places where we might have 
been a little comfortable. I've seen a lot of places where they've cut away some of 
the fat out there. We've almost eliminated our miles-in-trail restrictions at 
Oakland Center, for example. But I think we've reached the level we can handle 
with the technology we have today." 

Observations. The expanded NRP gave the airlines more flexibility and control in 
selecting the routes for certain flights. It did not provide the airlines with any 
increased flexibility as far as ground stops were concerned. 

Observation 4. Because of a closed runway, the arrival rate into LaGuardia for the 
next 3 hours was restricted to 75% of the normal rate. ATCSCC put a ground stop 
program into effect, holding a number of flights at other airports on the ground. 
Several affected airlines wanted to substitute some of their delayed flights for others 
that were still scheduled to leave on time, as these delayed flights were much more 
time-critical in terms of passenger loads and connecting flights. The ATM system 
had no easy mechanism to accommodate this desire. 

Observation 5. Traffic from the west into the northwest cornerpost at Chicago was 
very heavy. Consequently, this traffic was being sequenced to ensure efficient 
landings at O’Hare. When one airline wanted to file a flight from Minneapolis to 
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Chicago, rather than simply telling the airline that the flight would be delayed for 20 
minutes on the ground, the^ATM system gave it a choice: "You can take a 20 minute 
ground delay and then be assured that you can be sequenced into the flow at the 
northwest cornerpost, or you can take off now with a 20% chance of being fit into 
that sequencing and an 80% chance that you will be vectored to the northeast 
cornerpost instead." The airline decided for business reasons to go ahead and 
launch the flight. 

Observation 6. The expanded NRP raised certain concerns at some (but not all) 
Centers. As an example, one challenge arising from the expanded NRP was that 
airlines sometimes wanted to cross their high altitude flights over departure and 
arrival routes. Such flights criss-crossed through the departure lanes, creating a 
"very tricky, complex operation" for ATC. This raised an interesting question: Do 
you let 3 or 4 planes cross at the cost of slowing departures by about 20% ? This 
tradeoff was particularly interesting because such flights were most often slowing 
departures from Chicago of flights by two other airlines. 

In contrast, at Oakland Center such criss-crossing traffic through arrival lanes is 
being allowed, but not without significant concern. 

Another concern introduced by the expanded NRP was due to the instruction to 
give preference to NRP flights. As one TMO stated: "It gets cumbersome because 
the NRP program says you're not supposed to touch them. So we have to move 3 or 
4 other airplanes to solve one problem. They [the Command Center) encourage you 
to move other traffic to leave the NRP traffic alone." 

A fourth example that arose as a direct result of the expanded NRP at some airports, 
and also as a result of an increased numbers of direct flights, had to do with 
balancing of loads at comerposts: "If we get a jetstream right out of the southwest 
part of the country, everyone rides it [into O’Hare]. 75 percent of these airplanes are 
all coming in at the southwest cornerpost, creating a major volume saturation 
point. 

A sixth example of an issue associated with the expanded NRP concerned what was 
happening when there were arrival rate restrictions (due to weather, etc.). 

Observation 7. At certain Enroute Centers such as Chicago and Cleveland, 
numerous examples were noted where new problems with air traffic congestion 
arose. It is important to note, however, that many of these concerns did not arise 
because of the preflight plans filed under the expanded NRP. As one TMO reported: 
The source of the major concerns was not the expanded NRP per se; it was the spin- 
offs of the expanded NRP, such as the increase in direct routes that were filed while 
flights were enroute. The impact was that flights were now going direct through 
sectors where they had not done so in the past. Specifically, once airborne, pilots 
were requesting and getting clearances for direct routes from controllers, who were 
clearing them on these direct routes without any approval from the affected sectors. 
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This was apparently interpreted by these controllers as the "Free Flight" concept. 
(The actual order for the expanded NRP contained no such instructions.) 

There was also a problem with the unpredictability of traffic loads from day to day. 
In terms of the magnitude of this problem, 70 to 80% of the flights over many 
Centers were now on direct routes. For some Centers, such as Kansas City and west, 
this wasn't a major problem. For others like Chicago and east, there was a 
significant impact. Some aircraft had to be held at the Chicago Center, Cleveland 
Center, and Indianapolis Center boundaries because sequencing the resultant 
multiple flows became nearly impossible. 

Observation 8. Another potential challenge was a concern with commuter flights. 
With aircraft like the Challenger jets, "they want to go to 37,000 feet." How will this 
traffic be handled if they start to take advantage of the expanded NRP? 

Observation 9. As indicated above, pilots as well as controllers contributed to this 
sudden increase in direct flights. Pilots (with the permission of controllers) chose to 
fly direct instead of flying the route selected as "optimal" during preflight planning. 
A contributing factor in examples of this problem appeared to be a lack of awareness 
by pilots as to when they were on an NRP flight plan. Interviews with pilots from 
several airlines indicated that they did not know when they were flying a flight plan 
filed under the expanded NRP. 

Observation 10. A Dispatcher had a choice between filing a flight from LAX to DFW 
either north or south of White Sands. The northern deviation offered the shorter 
wind route. When the flight approached the northwest cornerpost for Dallas, 
however, the flight was vectored to the southwest cornerpost because of traffic 
congestion. As a result, the flight burned substantially more fuel and was later than 
it would have been if it had originally filed the southern route to the southwest 
cornerpost. 

Observation 11. A number of airline dispatchers and ATC coordinators were 
completely unaware of the dramatic increase in direct flights that occurred following 
the implementation of the expanded NRP (even though flights from their own 
airlines were involved). 

Observation 12. The system for requesting non-pref routes through ATCSCC under 
the old NRP (Advisory Circular 90-91) provided an example of how procedures can 
be established to encourage the distribution of knowledge to relevant participants in 
the flight planning process. As one airline ATC coordinator stated: "When we 

started this (the procedure for requesting non-pref routes], even Central Flow didn't 
know where all the choke points were. But as we pressed the system ... Originally, 
we'd call and they'd say no. But then it became: 'Well, if you would just do this, if 
you'd just make this minor adjustment in your flight plan, we could probably do 
this. It became a much more collaborative effort." 
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Observation 13. In contrast, 6 months later, after the start of the expanded NRP, this 
same ATC Coordinator noted: "The problem with the expanded NRP is that there's 
no feedback to the AOCs. Nobody's getting smarter. ... When we went to free flight 
on Jan. 9, we cut off the feedback loop for those flights filed under the expanded 
NRP. ... How do we get this local knowledge that the TMUs and controllers have out 
there for the dispatchers and pilots? ... There are problems in the ATC system that I 
don't know about. I need a mechanism to get feedback. ... 

Observation 14. The assumption behind free flight is that "if the airlines create a 
bottleneck and for 3 days in a row they get delayed, they'll change. The assumption, 
in other words, is that free flight represents a "free market" environment in which 
businesses will respond to problems in order to remain competitive. Upon 
implementation of the expanded NRP, however, new problems arose that resulted 
in consistent inefficiencies for certain flights. The airlines were often very slow to 
respond, however, taking weeks to recognize and react to such problems. 

Observation 15. TMO: "We don't even get a listing of who flew NRP the day before 
so we can review it and see what are the trends." 

2.2.2 Scenarios for Future Incidents and Cognitive Walkthroughs: the Gaming Area 

The scenarios developed for the Future Incident Technique and for the Cognitive 
Walkthrough were based on a common "gaming" area (Figure 2-4). An area was 
chosen in the contiguous United States, (roughly between 34° and 40° north 
latitude and 116° and 122° west longitude) that ranges from Los Angeles in the 
south to Reno in the north and from Coaldale, Nevada in the east to the California 
coastline in the west (see Figure 6). This area was chosen because of several 
characteristics that can accommodate many of the identified problems and 
constraints: 

• prohibited and restricted areas (military and special use airspace) that restricts the 
room to maneuver both for individual aircraft and the airspace manager; 

• the potential presence of military traffic asking for priority clearances; 

• periods of high traffic load, all of which is competing for the same airspace as it 
approaches San Francisco, creating a funnel of in-flowing aircraft; 

• north-south traffic to and from Los Angeles that may be in free flight and crosses 
the stream of traffic coming into the Bay Area; 

• the opportunity for several weather phenomena (thunderstorms being pushed 
up against the Sierra Nevada; clear air turbulence at altitude). 

Some of the rule changes that were used as probes in this research were instantiated 
as constants in the gaming area itself. For instance, the free flight zones inbound to 
(and outbound from) Oakland and Los Angeles do not exist today, and represent 
major differences as compared with today's situation. 
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Figure 2-3 Gaming area used in these scenarios 
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Glossary for the gaming area: 


Advisory non-binding information from ATC to flight crews concerning other traffic that is in the area. 

DEN Denver International Airport 

FL Flight level (FL320 is 32,000 ft; also referred to as ‘320" or ‘32"). 

FMS Flight Management System (on board most modem air transport aircraft) 

OAL Coaldale VOR, a waypoint for traffic inbound to San Francisco. 

PIT Pittsburgh International Airport 

RA Resolution Advisory, generated by TCAS 

TA Traffic Advisory, generated by TCAS 

TCAS Traffic Alert and Collision Avoidance System (on board aircraft). 

TOD Top Of Descent (the transition from cruise flight to descent) 

Transponder On-board receiver transmitter which will generate a reply signal upon proper interrogation. Only 

when the transponder is in ‘Mode C" will the reply signal contain the altitude of the aircraft being 

interrogated. Mode C (or Mode S) transponding is the basis for TCAS. 

V OR VHF OmwRange (a ground-based radio navigation beacon) 

W aypoint point along airway, often a VOR or an airport 

ZOA Oakland Air Route Traffic Control Center 

z Zulu time (also: Universal Time Coordinated, or LTC) 
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2.2.2 The Scenarios: Future Incident Reports 


In the conceptual walkthroughs of future incident reports, incidents that might 
occur and problems that might arise in a future Air Traffic Management (ATM) 
system are used to stimulate input from a group of people who play diverse roles in 
the current ATM system. These possible incidents are reported as if they had 
occurred in an incident report format including the sequence of events and why the 
problem may have occurred. The incident reports are used to structure discussions 
among experts (pilots, air traffic controllers, dispatchers, air traffic coordinators and 
traffic management unit coordinators) about the incidents themselves, the context, 
the roles of the different people and machines in the incident, the implications for 
future procedures and technologies, and the implications for future ATM systems. 
The method is designed to generate information quickly and efficiently on human- 
machine and human-human cooperation to help the aviation community move 
towards a new and more effective ATM system. 

Three incident report scenarios have been constructed, criticized and tested. The 
first is the baseline case; the second extends the first incident through the addition of 
an unanticipated disruption in the airspace (military traffic). See report no. 4 in this 
volume for discussion of the results obtained with these scenarios. 

2.2.3 Scenario Basis 

The scenarios were designed to include several major factors. First, there is a mixed 
locus of control, that is, there is a mix of controlled traffic and free flight traffic in the 
sector. This is done by including traffic that is transitioning from free flight to ATC 
control as they reach a point where they begin to be lined up for descent into the San 
Francisco area airports due to traffic density. At the same time there is a crossing 
stream of high altitude traffic operating under Free flight. 

Second, the traffic pattern overall is congested and complex creating heavy 
controller workload. 

Third, the scenarios were designed to create situations where there may be some 
transition in mode of control (variations from full free flight to more ATC control). 
One of the major challenges for a more flexible and less centralized traffic 
management environment is the need to be able to handle transitions in mode of 
control in order to cope with highly dynamic and unpredictable factors such as 
weather, emergencies, system failures. The scenarios were designed to represent 
examples of circumstances/ events that could make such a transition necessary. In 
the baseline scenario an encounter with turbulence affects a number of surrounding 
aircraft, changing the entire traffic configuration and creating the potential for ATC 
intervention. This creates a unanticipated situation where several aircraft begin to 
change their flight paths by more or less simultaneous maneuvers (as opposed to 
the serial creation of orderly traffic flows by a controller). The traffic pattern is 
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sufficiently complex that controllers may need to intervene to avoid problems. In 
the next incident an unanticipated transition in control is created by the need for 
priority handling of the military refueling in a free flight environment. 

Such transitions require highly effective coordination and communication between 
human(s) and machine(s) in the system. The scenarios focus on how this 
coordination and communication can break down for a variety of reasons some of 
which are included in the incidents: a stuck mike (no method of communication), a 
failed transponder (lack of important information for separation), a delayed 
response by a crew to a controller instruction in part related to assumptions about 
the protocol for digital communication, the lack of coordination between machine 
(TCAS) and controller instructions to crews, the lack of acknowledgments by some 
aircraft in response to the controller's broadcast message concerning the necessary 
transition in the 2nd scenario, etc. These events are introduced as probes to trigger a 
discussion with the participants in the meeting about how to avoid or cope with 
such problems by means of new procedures, technologies, and protocols. 

The issue of distributed decision making and responsibility is introduced by 
assuming an environment in which both pilots and controllers are supposed to 
maintain awareness and take necessary actions based on airborne and ground-based 
system information without the explicit need for communication before action. 
This may create problems for the controller who needs to create a picture of the 
traffic but without knowing intent and without being able to assume that the only 
thing that will change the picture (in predictable ways) are his own instructions. 

Another issue addressed by these scenarios is how controllers, as a kind of backup 
system, will maintain or regain awareness of the traffic situation. Here the challenge 
occurs based on the large number of aircraft and the complexity of traffic flows in 
that area, the mixture of aircraft equippage which makes it more difficult for the 
controller to know what clearances can be accepted/ handled by whom and how 
well, and how to communicate with aircraft (some data link, others voice), the 
additional challenge of working with a conflict resolution and advisory system. 

The third future incident was created to investigate the knowledge demands and 
goal trade-offs that are associated with the role of a pilot actively seeking his way 
through airspace, how dispatch can aid in making decisions, and whether 
minimizing the risk of ATC restrictions would be one of the goals of the flight crew. 

In the third incident, two aircraft are inbound for SFO under free flight rules. One 
of them, from DEN, asked ZOA for an advisory on crossing traffic to and from LAX, 
and initiated a right turn in order to avoid heavy crossing traffic. This brought the 
aircraft into conflict with another aircraft, inbound from PIT. Unwilling to climb, 
the PIT aircraft was late in reacting to a TCAS RA and safe separation was lost. This 
incident involved goal trade-offs for both aircraft: for one, the risk of conflicts vs. the 
cost of a hold, for the other, the risk of not making its destination because of low 
fuel and the risk of a loss of separation by a late response to a resolution advisory. 
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2.2.4 The Future Incidents 


Presented here are the specific documents and incident reports that were used in the 
conceptual walkthroughs of Future Incident Reports. They include a briefing guide, 
excerpts from Advisory Circulars and the Controller's handbook which provide 
background for the ATM policies and rules in operation in the ATM system at the 
time of the third incident, and voice transcripts and an ASRS Callback excerpt. 


The documents include: 

• A scenario participant briefing for the first and second incidents 

• First incident report used for retrospective analysis, 4/ 1997 

• Second incident report used for retrospective analysis, 11/97 


Paee 

2-19 

2-20 

2-23 


• Advisory Circular excerpt applicable to the third incident 2-26 

• Controller Handbook excerpt applicable to the third incident 2-27 

• Third incident report used for retrospective analysis. 1/98 2-28 

• Cockpit voice recorder transcripts from the third incident 2-31 

• NASA ASRS Callback excerpt 2-34 


Note: the documents on pages 2-19 through 2-34 are not real. They were created in 
1995-1996 in the Cognitive Systems Engineering Laboratory at the Ohio State 
University for the purpose of the research outlined in this report. 
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Scenario Briefing 


Background 

These scenarios take place in 1997 in Oakland Center airspace. The free flight 
concept has been implemented in enroute airspace, though terminal areas are still 
under ATC control and many aircraft are still not fully equipped for free flight. 
Some do not have data link, though all aircraft are equipped with TCAS-2 and Mode 
S transponders. Older aircraft do not have flight management systems, and the 
VOR/ DME airway system is still fully operational for aircraft which require it. 

Those aircraft which are equipped and choose to utilize free flight must still file 
flight plans to inform ATC of their intentions, but they do not require clearance to 
execute those flight plans and they are permitted to deviate from their original plan 
as required for the efficient conduct of their operations. They are expected to notify 
ATC of such deviations. Air Traffic Control facilities monitor all IFR aircraft, as 
they do today, but ATC will intervene with a free flight airplane only if it observes a 
potential conflict. Pilots are also expected to maintain traffic surveillance; TCAS-2 
with extended range is the system by which they observe traffic likely to come into 
conflict with their flights. 

Situation 

The two scenarios are duplicates; they differ only in complexity. Both take place 
during the period 2350-0020Z (1550-1620 PST), though on different dates. The 
weather in the vicinity of Coaldale involves scattered to broken decks of cirrus 
clouds between flight level 240 and 340; winds at those altitudes are 290° at 40-60 
knots. Light to moderate turbulence has been reported by pilots at all altitudes 
between FL 300 and 390. 

In each scenario, inbound traffic arriving from the east over Coaldale, the point of 
transition from free flight to positive control, is moderate and becoming heavier. 
Southbound traffic enroute to Los Angeles is still relatively light; northbound traffic 
is moderate. In the 2nd scenario, the traffic situation is complicated by the need for 
an emergency refueling of a military aircraft with hydraulic problems. 

Traffic in the area is under the surveillance and control of Oakland Center; the 
Center boundaries are shown in the incident reports. In the first scenario, conflict 
probe and resolution advisory software have recently been approved for operational 
use. In the second scenario, this software modules are approved for use under most 
weather conditions. Conflict probe is an automated system that evaluates (at this 
time in its development) possible conflicts occurring within five minutes; the 
resolution advisory module suggests avoidance maneuvers or flight path 
amendments to the controller. If the controller approves a suggested flight path 
change, it will be transmitted via data link to equipped aircraft, whose pilots will 
execute it manually or through their flight management systems. In aircraft 
without this equipment, the controller will issue amended clearances by voice. 
Equipped aircraft may also notify ATC of flight path changes by data link. 
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ATC FREE FLIGHT INCIDENT REPORT DATE: PAGEJ_0F.J_ 


This form will be used to report incidents involving aircraft in tree lllght as defined in Handbook 1 185 t Reports will be completed 
within live days ot occurrence and sent by lax to ATP-t 00 Appendices may be forwarded by ordinary man. 


1. SUMMARY (Indude graphics as necessary) 

SUMMARY* At approximately 00172 (1617 PST) on Friday, November 11, 1997, an incident 
occurred on airway J5 about 20 miles south of J80. The incident involved three civil 
aircraft northbound, two on free flight direct route*, and one aircraft southwestbound, 
also in free flight. All were under the surveillance of Oakland Center, which was also 
handling two streams of inbound traffic to KSFO and KOAK via CEDES and SUNOL. 

The responsible controller and the conflict detection system both detected the 
conflicts and provided resolution advisories which were forwarded to the aircraft. One 
advisory was too late to prevent a loss of standard separation; one was not acted upon 
in timely fashion by the affected aircraft. 

This incident was caused by a combination of circumstances* the conflict detection 
system did not predict one conflict soon enough to provide a timely resolution 
advisory; the controller, who was heavily loaded at the time, lost awareness of the 
effects of the clearance provided to one aircraft and foresaw the potential conflict to 
the other civil aircraft too late to provide a timely diversion. Contributing factors 
were the failure of the flight crew of one civil aircraft to act immediately on the 
clearance provided by ATC and a TCAS resolution advisory which conflicted with the 
resolution clearance provided by ATC. 

This incident has been reviewed with the responsible controller and has been 
incorporated into training materials at the Center. Predictive thresholds for conflict 
detection are being adjusted. The conflicting TCAS resolution advisory represents a 
problem of long standing and cannot be remedied by action at this level. 
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ATC FREE FLIGHT INCIDENT REPORT 

DATE: 04/2«/97 

PAGE 2 OF 3 

The form will be used to report Incidents Involving aircraft in tree (light as defined in Handbook 1 185 i Reports will be completed 
within five days of occurrence and sent by fax to ATP* 100. Appendices may be forwarded by ordinary mail 


2. DETAILED DESCRIPTION OF INCIDENT 


1. The incident occurred on airway J5 about 20 miles south of J80 at a time of heavy 
inbound traffic flow from the east toward San Francisco (KSFO) and Oakland (KOAX). 

The weather over Coaldale was scattered to broken cirrus cloud decks at multiple 
levels between FL 200 and 290; winds westerly at 70-75 kts. Light-moderate turbulence 
had been reported at all altitudes from FL 300-390 in the area. The incident was 
preceded by turbulence encounters by nearly all aircraft traversing the sector above 
FL 290. AA337, northbound to PDX in free flight, declared a descent from FL 330 to 

290; the other two northbound aircraft (Cessna N88Q, on J5 f and UA964, in free flight 
enroute PDX) were at or climbing to FL 290. NW905, southbound in free flight, was 

descending to 310 because of moderate turbulence at higher altitudes. 

2. At 0006, Kiwi 175 experienced a transponder failure 30 mi. SW of OAL enroute MOD 
descending from FL 290. This failure was not noticed for approximately 2 minutes. At 
0010:30, voice transmissions were blocked for It 30 by an apparent stuck microphone on 
VHF . 

3. At 0014, the controller recognized that a potential problem existed reference 
AA337, descending to FL 290 to avoid turbulence. He contacted AA337 and amended 337* s 
clearance to maintain FL 310, but AA 337, already below that altitude, was slow to 
respond. The DART readout indicates that AA337 descended to FL 294 and was in 
momentary conflict with Cessna N08Q maintaining FL 290. N88Q was also recommended to 
descend to FL 200 but separation was lost between N88Q and UA964. UA964 was given a 
right turn by voice when the controller realized that 88Q and 964 were converging, but 
this transmission was blocked by UA964's call of N88Q as traffic in conflict. At 
0015, the controller recognized a potential conflict of AA337 with NW905 and amended 
NW905's clearance to maintain FL 330. 

4. N88Q and UA964 received resolution advisories from their TCAS units, which directed 
N80Q to descend but directed a climb for UA964; the climb, which was not notified to 
ATC until it was completed at FL 300, brought UA964 briefly into conflict with AA337. 

5. The controller was busy handling the stream of inbounds to KSFO/KOAK and keeping 
them clear of the crossing aircraft in free flight. He indicated that he expected the 
crossing traffic to be well above the descent altitudes for aircraft crossing J5 and 
J7 , as is usually the case in this area. Additionally, he was maintaining close 
surveillance of the automatic conflict detection and resolution software, which has 
just been placed in operation in this facility, and this added to his workload. 

Finally, the TCAS advisory to UA964 was not notified to ATC until after the aircraft 
had leveled at or close to FL 300 after climbing on a converging course with AA337 and 
this momentarily posed yet another problem for the controller, who had to evaluate 
another potential conflict before the others had been fully resolved. 
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ATC FREE FLIGHT INCIDENT REPORT DATE: 04/26/97 


The form win be used to report Incidents involving aircraft in tree flight as defined in Handbook 1 165. 1 Reports will be completed 
within live days of occurrence and sent by fax to ATP- too Appendices may be forwarded by ordinary man. 


3. ANALYSIS, FINDINGS, RECOMMENDATIONS 

ANALYSIS* 

DAFT and data linJc readout* were prepared after the incident. The above summary was 
prepared from the tapes on 04/29/97. During interviews, the controller indicated that 
he lost the picture of his north-south crossing traffic momentarily because of the 
large number of altitude changes being undertaken by these and other aircraft; he was 
unable to reestablish a clear picture because not all of the flight data had been 
updated. In particular, AA337's altitude revision did not appear on that aircraft's 
flight data screen until after the incidents, probably because of late processing of a 
data link message. 

FINDINGS* 

Conflict alert software functioned correctly, but did not provide enough advance 
notice to the controller of the conflict between AA337 and N88Q to resolve the problem 
without loss of separation. Point of closest approach between these two aircraft was 
approximately 0 ft and 2-1/2 miles. Also, AA337 was slow to respond to its resolution 
clearance and UA964's crew said they did not have time to acknowledge their TCAS 
advisory until they had responded with a climb. Complexity in the sector was moderate 
prior to the incident, in large part because of the north-south free flight and 
controlled aircraft, which were either requesting or executing descents or altitude 
amendments to avoid the turbulence above FL 290. 

There is an unresolved problem in areas containing a mix of free flight aircraft and 
aircraft under positive control. This mix is characteristic of this and some other 
sectors under control of this facility. Under some conditions, it becomes necessary 
to segregate controlled from uncontrolled aircraft, yet this cannot be done without 
imposing restriction* on aircraft in free flight, which conflicts with policy guidance 
concerning free flight. The alternative is to require that aircraft inbound to a 
terminal area be descended earlier, to keep them below the paths of overflying enroute 
traffic, and this also conflicts with the principles of free flight. Until this 
problem can be resolved, however, incidents like these will continue to occur unless 
controllers assume a greater degree of control over the enroute traffic. 

RECOMMENDATIONS * 

It is recommended that until new policies and/or technologies to avoid this sort of 
situation can be worked out, unrestricted flight under the free flight program end at 
some point prior to the primary inbound fix serving a terminal area, so that 
controllers can establish more orderly traffic flow prior to having to accommodate the 
streams of crossing traffic. Attempting to do this diverted attention from the 
separation task and increased the sector controller's workload at a time when he was 
already planning for the handling of a substantial number of aircraft while trying to 
accommodate north- and southbound aircraft transiting the sector. 

Unexpected concentrations of traffic such as occurred in this case can occur without 
warning. Procedures to invoke positive control in place of free flight need to be 
able to be invoked rapidly to permit orderly handling of such situations. 


4 TYPED NAME OF PREPARING OFFICIAL 

Oliver S. Ulrich, Supervising Controller 


FACILITY 
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ATC FREE FLIGHT INCIDENT REPORT 


DATE: n/ii /97 


PAGE i OF ^ 


Th,s form will be used to report incidents involving a, rcraft in free flight as defined in Handbook 1165 1. Reports w.ll be completed 
w.th.n five days of occurrence and sent by fax to ATP-iqq Appendices may be forwarded by ordinary man P 


1. SUMMARY (Include graphics as necessary) 

SUMMARY: At approximately 0017Z (1617 PST) on Friday, November 11, 1997, an incident 
occurred on airway J5 20 mi. eouth of J80. The incident involved two Air Force 

4 KC-135 tanker and a C-141 receiver, proceeding as a flight of two toward 
Castle AFB on a priority clearance. The tanker-receiver flight was in conflict with 
two civil transport aircraft northbound on direct routes under the control of Oakland 
Center, which was also controlling the Air Force aircraft. The two civil aircraft also 
were involved in an operational error at about the same time. 

Conflict detection and resolution programs detected the conflicts and provided 
resolution advisories which were forwarded to the transports by the responsible 
controller. One advisory was too late to prevent an incursion into the refueling 
block; one was not acted upon in timely fashion by the flight crew. 

This incident was caused by a combination of circumstances: the conflict detection 
system did not predict one conflict soon enough to provide a timely resolution 
advisory; the controller, who was heavily loaded at the time, foresaw the potential 
conflict between the two civil aircraft too late to provide a timely diversion. 
Contributing factors were the failure of the flight crew of one civil aircraft to act 
immediately on the clearance provided by ATC and a TCAS resolution advisory which 
conflicted with the resolution clearance provided by ATC. 

This incident has been reviewed with the responsible controller and has been 
incorporated into training materials at the Center. Predictive thresholds for conflict 
detection are being adjusted. The conflicting TCAS resolution advisory represents a 
problem of long standing and cannot be remedied by action at this level. 
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ATC FREE FLIGHT INCIDENT REPORT 


DATE: 11/11/97 


This form wll be used to report incidents involving aircraft in tree flight as defined in Handbook 1 165.1. Reports wifi be competed 
within five days of occurrence and sent by fax to ATP-ioo. Appendices may be forwarded by ordinary mail. 

Z DETAILED DESCRIPTION OF INCIDENT 

DETAILS OF THE INCIDENT i The incident occurred on airway J5 about 20 miles south of 
J90 at a time of heavy inbound traffic flow from the east toward KSFO and KOAK. At 
2400, ZOA received a request for a priority clearance for ICEMAN 26, a KC-135 tanker 
aircraft which had been refueling ASPEN 15, an SR-71 within Edwards AFB airspace, for 
an emergency refueling on an east-west track crossing OAL between FL 250 and FL 300. 

The refueling involved a C-141, SAFEGUARD 36, enroute to Kirtland AFB carrying 
hazardous cargo, which had experienced an engine failure and had hydraulic system 
problems . 

The weather over Coaldale was scattered cirrus cloud decks at various levels between 
FL 200 and 280; winds westerly at 70-75 kts. Light-moderate turbulence had been 
reported at all altitudes from FL 300-390 in the area. 

The clearance was issued at 0001 and the tanker departed the Edwards range northbound. 

All aircraft with data link capability were immediately notified that the Free Flight 
Zonal Boundary was shifted 100 miles to the east of OAL. The same message was 
broadcast on voice channels and ZLC was asked to notify non-data link aircraft still 
in its airspace of the change. Center tapes indicate that this message was 
acknowledged by most, but not all, aircraft affected by the change. 

At 0004, the tanker reported radar contact with its receiver from a position 15 west 
of OAL and commenced a right turn to 040. At 0007, ZLC handed off the C-141 40 NE of 
OAL proceeding southbound. Shortly thereafter, the tanker reported visual contact 
with the C-141 and commenced a right turn toward a heading of 235* direct Castle. The 
C-141 followed and joined at 0010 at FL 290. Refueling convnenced immediately. 

At 0006, Kiwi 175 experienced a transponder failure 30 mi. SW of OAL enroute MOD 
passing FL 270. This failure was not noticed for approximately 2 minutes. At 0010, 
the watch supervisor at ZOA recognized that traffic in the affected sector was 
becoming heavy and assigned an assistant to the sector. At 0010 t 30, voice 
transmissions were blocked for 1 « 3 0 by an apparent stuck microphone on VHF . 

The operation was made more complex by a number of north- and southbound aircraft in 
free flight to and from the Los Angeles area, some of which were descending to FL 
280/290 to avoid turbulence at higher altitudes. Among these aircraft were AA337, 

Cessna N88Q and UA 964. AA337 was descending to FL 290; N88Q and UA 964 were 

maintaining FL 290 because of turbulence. Southbound NW905 was also descending to 310. 

The conflict detection module recognized potential conflicts and recommended that 
AA337 climb to FL 310; this clearance was transmitted on data link, but the aircraft 
was slow to comply and crossed over the military aircraft about 800 feet above and a 

half mile ahead of them. N89Q was recommended to descend to FL 280 but separation was 

lost between N08Q and the tanker-receiver pair before the data link clearance was 
acknowledged. N88Q and UA964 also experienced TCAS resolution advisories. UA964 was 
given a right turn and immediate climb by voice when the controller realized that 68Q 
and 964 were converging, but entered the refueling block at FL 294 about 1 mile east 

of the military aircraft and two miles east of N80Q. The tanker maintained its course 

and altitude because the receiver was experiencing intermittent difficulty maintaining 
directional control; the tanker called AA337 and N88Q as traffic but did not observe 
the United aircraft. It reported refueling complete at 0019 and began an immediate 
descent toward Castle AFB with the receiver following. 
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ATC FREE FLIGHT INCIDENT REPORT 


DATE: 11/11/97 



This form wiN be used to report incidents involving aircraft in tree flight as defined m Handbook 1 165 1 Reports will be completed 
within five days of occurrence and sent by fax to ATP- 1 00 Appendices may be forwarded by ordinary mart. 

3. ANALYSIS, FINDINGS, RECOMMENDATIONS 


ANALYSIS i 

DAFT and data link readouts were prepared after the incident. The above summary was 
prepared from the tapes on 11/15/97. During interviews, the lead controller indicated 
that he lost the picture of his north-south crossing traffic for a short time because 
of the large number of altitude changes being undertaken by these aircraft; he was 
unable to reestablish a clear picture because not all of the flight data had been 
updated. In particular, AA337*s altitude revision did not appear on the flight data 
screen, probably because of late processing of a data link message. 

The conflict resolution software functioned correctly, but did not provide enough 
advance notice to the controllers of the conflict between N86Q and UA094 to resolve 
the problem without loss of separation. Point of closest approach between these two 
aircraft was approximately 0 ft and 2-1/2 miles. Also, AA337 was slow to respond to 
its resolution clearance and N08Q did not have time to acknowledge its amended 
clearance via data link, though it did acknowledge by voice. 

Complexity in the sector was high prior to the incident, in large part because of the 
north-south free flight aircraft and the refueling path taken by the tanker because of 
its receiver's control difficulties. These aircraft were on UHF, which was not 
blocked by the stuck microphone on the VHF channel, but it was not immediately clear 
which channel was obstructed and the controller was concerned about KI175's altitude 
reference the refueling block. 

RECOMMENDATIONS i 

Because of the high likelihood of "bunching" at points on the periphery of the Free 
Flight zone, it is recommended that Free Flight end at some point prior to the primary 
inbound fix serving a terminal area, so that controllers can establish more orderly 
traffic flow prior to having to merge the streams of inbound and crossing traffic. 

The zonal boundary was moved during this incident, but doing so diverted attention 
from the separation task and increased the sector controller's workload at a time when 
he was already handling a substantial number of aircraft and planning for the effect 
of the refueling on or near J-60. 

Though free flight is now accepted policy, it should be noted that when numerous 
aircraft submit altitude or course changes nearly simultaneously, it can be difficult 
for controllers to adjust their crossing traffic flows to take account of the new 
aircraft trajectories. This was also noted in the earlier expanded NRP program when a 
sector contained both enroute ( NRP ) traffic and traffic transitioning to a terminal 
area. The situation that occurred here is not specifically cited in current 
procedures . 

Unexpected concentrations of traffic such as occurred in this case can occur without 
warning. Procedures to invoke positive control in place of free flight need to be 
able to be invoked rapidly to permit orderly handling of such situations. This poses 
a particular problem close to the boundaries of a Center's airspace (the 2LC boundary 
lay within the area in which the tanker and receiver joined up). 


4 TYPED NAME OF PREPARING OFFICIAL 

FACILITY 

DATE 

Oliver S. Ulrich, Supervising Controller 

ZOA-112 

11/15/97 
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© 

U.S. Department 
of Transportation 

Federal Aviation 
Administration 


Advisory 

Circular 


Subject: OBSTACLE-BASED CONTROL Date: 2/11/97 AC no: 81-85C 
IN FREEFLIGHTAIRSPACE Initiated byAFS-840 


1. PURPOSE This advisory circular (AC 
provides guidance for pilots on operating 
procedures in and around obstacles m free flight 
airspace, as contained in Federal Aviation 
Regulations (F AR) part 141 

2. CANCELLATION AC 90-91. Operating 
procedures: National Route Program dated August 
6 . 1992 is cancelled and superceded by this 
advisory circular AC81-85C 

3. OTHER DOCUMENT ATION Free night 
principles are discussed in the 1995 final report of 
RTCA Task Force 3. 


4. THE CONCEPTS. When free flight cannot 
be maintained becaise local problems have arisen 
that demand positive air traf fie control, it is 
important that controllers set aside the MINIMUM 
safe amount of positive control airspace to order to 
maintain ef ficient traf fie flow 

a. Obstacle -based contr ol allows controllers to 
set aside parts of their sector for positive control, 
and free flight traf fie can be asked to divert around 
these obstacle areas - to continue unhampered as 
long as it stays clear from the resectored area. In 
other words: traffic within an obstacle area where a 
problem has arisen is under positive control H will 
receive radar vectors and altitude clearances, 
whereas traf fie outside the obstacle area is still in 
free flight and can merely be asked to stay outside. 

ft. Thg tutdfor obstack artes in free flight 
airspace may arise during local problems (such as 
severe concatenations of inf fie, or an emer geocy of 
one aircraft) that demand clearance- based control. 
Where this is the case, an obstacle area can be 
declared by the controller 


Aircraft within the obstacle area will be required to 
submit to positive control and comply with 
controller clearances. This allows the controller to 
actively solve the problem in the local area, while 
creating minimum interference with free flight 
traffic around the obstacle area. 

5. COMMUNICATIONS. This section 
explains the communications in obstacle-based 
control, as set forth in F AR part 141 and the 
Aeronautical Information Manual 1997 

a. Controlkn can be expected to broadcast to 
aircraft within their sector the geographical and 
altitude boundaries of the area that will be. or just 
has been.declared positive control obstacle area 
Controllers can use both latitude longitude 
information or make reference to VOR-DME 
beacons or airports. For instance, a broadcast 
message may sound 'area from OAL VO R to 50 
nm west of OAL stretching lOnm north and lOnm 
south of OAL between FL200 and FL330 is now 
under positive control.” It will shortly be possible to 
digitally uplink the geographical area with altitude 
information, onto navigation displays of rightly 
equiped aircraft Wthin the obstacle ana 
pilot-controller communications proceed as oormal 
under clearance -based control (see AIM 1997) 

b. Pilots do not need to verbally acknowledge 
the obstacle broadcast and are free to circumvent 
obftacle areas. If pilots wish to enter the obstacle 
airspace, they need to ask for an ATC clearance to 
do so - as is the case with entry into any non- free 
flight airspace today Unauthorized entry Into 
positive controlled obstacle airspace Is pr oUbtted 
under FAR 141. Once within obstacle airspace, 
pilots are under positive control and may not 
deviate from altitude, beading, or airspeed 
clearances without controller permission. 
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9110.65FF 


Section 1. OBSl\CLE-BASED CONTROL 


5-59 FREE FLIGHT CONCEPT 

Free flight can provide the needed flexibility and 
capacity for the forseeable future. It enables 
user- preferred flight paths that can be dynanically 
adjusted: the pilot is able to operate the flight 
without specific route, speed, or altitude clearances. 
Restricting the flexibility of the pilot will only be 
necessary when: 

1) potential maneuvers may interfere with other 
aircraft operations: 

2) traf fic density in congested airspace precludes 
free flight operations: 

3) unauthorized entry into special use airspace is 
imminent; 

4) safety of flight restrictions are considered 
necessary 

5-60 APPLICATION 

In case of any of the conditions under Par 5—59 
sub I)-4). controllers should resist revoking free 
flight within entire sectors. They should ao this only 
when it is absolutely necessary The above four 
conditions happen often in local areas, rather than 
across an entire sector Therefore, to adequately deal 
with a problem, free flight can often be revoked only 
in local areas, rather thao in an entire sector 

When free flight cannot be maintained because 
local problems arise that demand positive control, it 
is important that controllers set aside the minimum 
safe amount of airspace to deal with the problem. 
Within the portion that is set aside, controllers will 
manage aircraft under positive control. Other free 
flight traffic that is not going to he part of the 
problem can be requested to divert around the 
portion This will facilitate safe, orderly and 
continuously ef ficient flow of traf Fic in free flight 
airspace. 

5-61 TERMS 

a* obstacle -- the area, or volume, of positively 
controlled airspace set aside by the controller 
Within the obstacle, air traf fic can be given heading, 
speed, or altitude clearances, or other bods of 
information or directives that help the controller deal 
with the local problem The portion set aside is 
called an obstacle, because that is what it creates for 
free flight traf fic: an obstacle that they must 
circumvent in ways that are as economical as 
possible for them 

b. obstacle -based conrr ol — the procedure of 
setting aside a portion of airspace to deal with local 
problems and having free flight traf fic divert around 
it 


c. affected atr craft ~ the aircraft that are going to 
be in the obstacle and under positive control 

d. non-affected air crcfft -- the aircraft that are not 
in the obstacle, but still in free flight somewhere 
around the obstacle. 

5-62 OBST ACLE METHODS 

When free flight must be revoked locally to deal 
with any of the conditions under Par . 5-59 sub l)-4). 
use the following method: 

a. Inform the a f fected aircraft that they are of f 
free flight and proceed to give them the clearances 

or other information or directives necessary to solve 

the problem 

Phraseology: 

(identification) YOU ARE NOW OFF FREE FUGHT 
TURN HEADING/ DESCEND/ CLIMB/ SLOW TO 
(give clearance) 

b. Broadcast to the non-af fected aircraft where 
the obstacle is that they should circumvent. A 
controller can do this by reference to 

latitude longitude information or by reference to 
VOR-DME and or airports. In some cases other 
landmarks or airspace characteristics can be used « 
well, such as boraera of niliury or special use 
airspace The altitude range of the obstacle should 
also be made specific by reference to flight levels or 
thousands of feet. 

Phraseology: 

FREE FLIGHT TRAFFIC IN SECT OR (identify 
sector) THERE IS AN OBSTACLE FROM (give lateral 
boundaries). RANGING FROM (give altitude 
boundaries). 

Note: NO acknowledgement Cr om free night 
traffic about the broadcast la necessary; It sboaid 
therefore aot be awaited or expected by the 
controller . 

c If the controller is uncertain about reaching all 
free flight traf fic. be can request specific aircraft 
within this traf fic to relay the broadcast. 

<L If an aircraft in free flight is inadvertently about 
to enter the obstacle, this situation is similar to the 
one under Par 5— 59 sub 3). The controller can take 
this aircraft of f free flight using the method under 
Par 5-62 sub a. 

Note: Noa-affected traffic la aot allowed to enter 
the obstacle with on t a clearance fr om the 
controller . 

c. If a non-af fected aircraft wishes to negotiate 
about entry into the obstacle, the controller can 
accept this traf fic, workload permitting. 

5- 6 2a Refer enee- FAR pari 141 : Aeronautical 
Information Manual 1997. 


Para 5-59 


1 1-11-3 
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1. SUMMARY (Indude graphics as necessary) 


SUMMARY t At approximately 1915Z (1115 PST) on July 6, 1998, an incident occurred 5nm 
east of Coaldale, near the Free Flight zonal boundary for east inbound traffic to San 
Francisco. The incident involved two civil transport aircraft inbound to KSFO under 
free flight rules. 

One of the aircraft, inbound from DEN, initiated a right 360 degree turn before 
reaching Coaldale VOR (OAL) to let crossing North-South free flight traffic west of OAL 
pass in front of him. The right turn brought this aircraft in conflict with another 
civil transport inbound on a great circle route from PIT. The latter aircraft, 
descending in order to be over OAL at FL240, reacted too late to the T/CAS resolution 
advisory, and safe separation could not be maintained. 

Since both aircraft were under free flight rules, the controller was not actively 
involved in separation. Controlling traffic closer inbound to OAK, SFO and SJC had his 
first priority. 

The incident was caused by a self-initiated 360 turn of one of the aircraft and a late 
reaction to an RA of the other aircraft. The fact that ATC cannot actively monitor all 
of the free flight traffic, let alone predict their movements, is thought to be a 
contributing factor. 

The recommendation that the free flight boundary be extended 50 miles to the east of 
OAL was not acted upon after free flight incident 11/11/97. The latest incident 
indicates once more the clear need for active control east of Coaldale. 
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ATC FREE FLIGHT INCIDENT REPORT 


DATE: °i/22/98 


PAGE 2 OF ^ 


This form will be used to report Incidents involving aircraft in Jree flight as defined in Handbook 1 185 t Reports will be completed 
within five days of occurrence and sent by fax to ATP»ioo, Appendices may be forwarded by ordinary mail. 

2. DETAILED DESCRIPTION OF INCIDENT "" ” ~~ "*~ = — 

DETAILS OF THE INCIDENT * The incident occurred mid-morning, at a time of light to 
moderate inbound free flight traffic flow from the east toward San Fransisco. Due to 
a coastal winter front, the weather was IMC from FL 290 down to approximately 500ft. 

At 1902Z, a B737, inbound from PIT on a great circle route in free flight announced to 
Oakland Center it estimated to cross inbound fix (OAL) at 1917Z and requested FL240 
crossing OAL with subsequent straight-in for SFO. FL240 for crossing OAL was approved, 
as was direct OAL to SFO. 

At 1905Z another inbound aircraft, an A320 from DEN, reported 20 miles east of OAL, 
and asked Oakland Center to get a traffic advisory about crossing north-south 
freeflight traffic that was flying west of OAL. 

Oakland Center reported incoming waves of crossing free flight traffic i one to the 
north, and one to the south of the A320‘s projected track beyond OAL. Most of this 
traffic would have cleared the area in 5 to 10 minutes. The A320 asked whether it 
could hold briefly east of OAL at FL240, and go through the area of crossing traffic 
later. The responsible Oakland Center controller told the A320 he was welcome to do 
so, but advised the A320 of traffic at four-o-clock high. This was the B737 inbound 
from PIT. Both aircraft were in free flight, so Oakland center took neither the A320, 
nor the B737 under positive control. 

Due to a number of missed approaches in IMC at SFO and OAK between 1906z and 1915Z, 
the Oakland Center controller became preoccupied at that timet he had to coordinate 
with SFO and OAK approach control in order to re-vector his aircraft around SFO and 
OAK. Priority was given to this positive controlled inbound traffic west of OAL. The 
A320 crew reported that they attempted unsuccesf ully to contact Oakland Center between 
1910Z and 1914Z in order to confirm the feasibility of a temporary hold east of OAL. 

At 1906Z, the B737 had started a descent (in free flight) in order to be over OAL at 
FL240. 

At 1914Z the A320 initiated a 360 degree rate 1 right turn. Turning right was its only 
option, given restricted Edwards Ranges to the South. This turn brought the A3 20 in 
direct conflict with the oncoming B737. The B737 did not act quickly enough to its 
resolution advisory (which asked the B737 to climb) and separation was lost between 
1915Z and 19162. The A320 responded to its RA by descending, but also aborted its 
turn, now flying outbound from OAL on a northeasterly heading and passing in front of 
the B737 from left to right at an estimated distance of 2 miles. 

At this time the Oakland Center controller had been alerted by conflict detection 
software. He declared the area just east of OAL positive control so he could vector 
the aircraft across OAL. The B737 received permission to cross over OAL at FL240, and 
the A3 2 0 was asked to continue the right turn and was brought in behind the B737 , also 
at FL240. Most of the crossing traffic had cleared the area just west of OAL by then, 
and no further conflicts or RA’s occurred. 
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ATC FREE FLIGHT INCIDENT REPORT 


DATE: 01/22/90 


This form win be used lo report Incidents invoMng aircraft In free flight as defined in Handbook 1 165. 1 . Reports will be completed 
within five days o« occurrence and sent by fax to ATP- 100 Appendices may be forwarded by ordinary mail. 


3. ANALYSIS, FINDINGS, RECOMMENDATIONS 

ANALYSIS i A DART readout was prepared after the incident. Tapes were sequestered. A 
transcript of the intra-cockpit communications of both the A320 and B737 as well as 
applicable Oakland Center communications are attached to this report. 

By asking Oakland Center for a traffic advisory and the option to hold, a climate was 
created in which it had become unclear exactly what kind of control the A320 was 
under. Although technically still under free flight rules, the A320 had put itself in 
a position where it wanted confirmation from ATC about the 360 turn it was about to 
make. Whether the pilot intended to ask permission is unclear, and at any rate, this 
would not have been necessary since the aircraft was not under positive control. 

The responsible Oakland Center controller could have anticipated that a problem might 
develop after the A320 asked for traffic information. The controller knew that other 
traffic was in the area and that a potential problem between the freely turning A320 
and other traffic could develop. It would have helped the A320 in his judgment of 
whether to turn or not if the controller had told him that the B737 was not just 
traffic 4-o-clock high, but actually inbound for the same fix. 

Under free flight legislation - that is in favor of efficiency - controllers are 
encouraged to take active control only when safety is clearly at stake. The 
responsible Oakland Center controller judged that this was not yet the case, given the 
light traffic load east of OAL. 

RECOMMENDATIONS i It is believed that permanent positive control east of OAL will 
prevent these situations in the future. Once more, it has become clear that active 
involvement of Oakland Center in the funneling of aircraft east of OAL is safe and 
necessary . 

Crossing traffic that is flying in free flight remains an issue of some gravity. It 
seems backwards from an efficiency standpoint that incoming traffic (needing to keep 
their slot times etc.) should have to wait for traffic that is in cruise. In addition, 
the weaving of controlled traffic through free flight traffic is not without hazards. 


ATTACHMENTS! 

1. transcript of intra-cockpit communications of A320 and B737; 

2. transcript of ATC communications; 

3. relevant NASA ASRS Callback. 


4 TYPED NAME OF PREPARING OFFICIAL 

FACILITY 

OATE 

Curt S.E. Langendorf, Supervising Controller 

20A-112 

01/30/90 
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APPENDIX 


COCKPIT VOICE RECORDER TRANSCRIPTS 

Respectively from: 

AW 335 A320 
US 111 4 B737 


LEGEND 


rdo Radio transmission from incident aircraft 

cam Cockpit area microphone voice or sound source 

-l Voice identified as Piloi-in-Command 

-2 Voice identified as Co*Pllot 

oak Radio transmission from Oakland Center 

ops Radio transmission tronfcmerica Wfest Operations Control (Dispatch) 

• Unintelligible word 

# Expletive 

( ) Editorial insertion 

Pause 


Note: all times are in UTC (Zulu time) 


Albert G Reitan 

Transportation Safety Specialist (CVR) 


Note: This document is not real • it has been created for research purposes only 




NTRA-COCXPlT COMMUNICA TlON 


AlR-GR OUNO COMMUNICA TlON 


time & 


TIME A 


SOURCE 

CONTENT 

SOURCE 

CONTENT 


START OP transcript CA CTUS 33S A320 


1 854 39 
CAM-2 


Man U*o protty adamant about mta 

upa*t tnmg this mommg 


1855 27 
CAM-1 


1856 10 
CAM-2 


vou can aay mat a gam Guoaa rt snook m up 
pr«tty bad # pasaongart you can tod m a 
miikon ttm«« to waar m*»r / dmi i cam hotp « 
<i may std bang tho* 9 naaos 

'* ha no ho 


1 856 1 9 T*| y a what Lara a« d spa to ft what thay ttnow 

CAM- 1 •*• * h *i thay d want ua to do rf rts bad agar 

attar Coaidata 


1859 04 
CAM-2 


Swal 


1900 29 

RDO-2 


Opa goodmorTwtg this >s thraa t firry fiva 
roound SPO 


1 900 46 *** haao thara thraa thrty fiva what can i do 

OPS toryou^jya 

’ 03 Opa you got any tnng on croaamg traa tight 

RDO-2 trafc attar Coaidaia whai wo ahoud do with rt’ 


1901 27 
OPS 


Stand by m naad to chock 


1902 21 
OPS 


Taoh ah thraa thirty liv a ah l‘va found a momo 
hara ruat got ft this morning Soya that if an 
thara * much oroaamg trdfc bayond Cookwio 
thara ftkaty to cauaa iota or upsora. than an you 
might waM to chock wrtRTC ard hold aaat of 
Coaidaia ao you can go through at a lator tana 
Ah it aaya too that ah smcawahavano 
connocaon* tor thrs fight at SFO ah bia b«a bia 
an attar what happonod yaatarday gvmg 
tham a smooth nd# m i* moro important man 
gating thorn tharo oarty right whatawar that 
may moan 


INTRA-COCKPIT COMMUNICA TlON 

TIM£ & 

SOURCE CONTENT 


AIR-GR OUNO COMMUNICA TlON 

TIME A 

SOURCE CONTENT 


1904 23 
CAM-1 
’904 37 
CAM- 2 


Sounds Mo wo want to cal Oakland mr* too 
what thoy hava 

voah youTon^tt 


1903 28 
RDO-2 
1903 40 
OPS 


1905 10 
RDO-2 

1905 19 
OAK 

1905 30 
ROO-2 


1905 56 

OAK 

1906 10 
OAK 


1 906 27 
CAM-1 
1906 35 
CAM-2 


Wow 

Pratty much maana wa d hava to notd for a ntia 
win* huh 


1906 39 
CAM-1 


voan tart ask m 


OK opt manat sppraciata it 


*>uTaw*ieomaguys goodday 


Oakland cantoc Coctuaihrao thirty r<vo80 
mios oast ot Coaidaia an meound SPO 


Cactua thraa thraa fiva i gotcha Koap on 
eommg m 

Ah oaktand ah wa d kfca to nav a a rttf 
•dv«ory is thara much m*uh to tho norm 
and south of ua attar w* past Coaidaia uh 
coiroction much erosamg trdt frao flight 
croawng trafc that waD hov a to go through'’ 


Cactus st an Ay 


uh Cactua urtdrhaflva youva got a tog 
wavo to tha north of you and uh standby 
ah looks kka thoro’t a lot to tho south sa wok 
woto gonna nova to do a lot ot woavng 
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I NT RA -COCKPIT communica TION 


AIR-G * OUND COWMUNCA TION 


TIME & 
SOURCE 


CONTENT 


time & 

SOuRC£ CONTENT 


1906 43 
RDO-1 

Oakland Cactus thraa thirty ftva wa'd hka to ah 
bnally hold aaat of Coaidala to iat crossing 
tratic pass 

1906 59 
Oak 

Rogar sir ah thraa thraa fiva ah do as you want 
tratic 4-o -clock high juft ta4 m* whan you 
want to coma in 

1907 20 
RDO-1 

Oakland ah wa doni hava trkfc on tha visual 
orTCAS So ah wa r# ah eiaarad for this 
hold ah wrico on whan wa coma m thraa thrty 
fiva 

1907 43 
OAK 

sr 


1906 10 

CAM-2 * y#l that WM •••y 


1906 29 

CAM-1 


1 906 54 
CAM-2 


1909 15 
CAM-1 

1909 22 
CAM-2 


Yaah uh now wa n««d to go do mu hold to 
tha right don't wa? Wva got Emtrdi « 
somathm' hara to tha south. nght? 

•h nimni chack oh yaah that's right yaah 
Edward! So gotta tom north Now thara's 
trafrc at four-o-ctock hiap to that's to tha nght 
barmd us somawnara out rt'a 

north OK lot's atk m ono mora tima 


good plan 


1910 36 Oakland Cactus tnraa thirty fiva wa d iiks to an 

R00- 1 wanly hok) to north 


INTRA -COCKPIT COMMUMCA TON 

TIME & 

SOURCE CONTENT 


191 1 45 
CAM-2 


191210 

CAM-1 


191300 

CAM-1 


Notgood W a gam start darq aomaft r g 
prwvy soon harm. 


1913 47 

CAM-2 

1913 56 
CAM-1 

1914 16 
CAM-5 

191425 

CAM-1 


whavatursfe now? 

MLaTtUn 

oaffa. as# «a lasts* of TCA« sdmaory] 


Wfmm Ml. 1 


1914 37 
CAM-5 


daa c a n d. d—cwd , daa e and |ao»rt o I TCAS 
admaoryl 


END OF TRANSCRIPT 


AIR-GR OUNO COMMUNKTA TION 

TIME & 

.SOURCE CONTENT 


191 1 13 
RDO-1 


Mas tvty Ma? 


1912 33 
RDO-1 


Oakbid Canlar 


*va 


1913 31 
RDO-1 


OatMl Cm tm CacU rraw tvty Ma wnw 
urvtg nom. ah hatdkig ***t of Cowdaia 


1915 18 
OAK 


Caatui thraa thras hv* you aknosi Saw rxo a 
USAr aawan rrwa Warur taua and Sy 
haatfcig xsro Ms zwro 
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callb ack yds 

Number 224 Februaiy 1 99 


So, who's in control, anyway? 


Whes aircraft m fret flight ask and mart advisory 
infocmatioo fromATC, and act on the basis of 

this inform afron. is it fair that the craw expect further 
assistance fromATC in. for instance, separatum? Or doe* the 
free flight adage of *iee and avoid" still hold and is the crew 
*oa tU own’, so to say?This was exactly the dilemma an air 
transport crew found itself in when it had asked a t*£ 
advisory for free High* trafic croasmg in from of it 

First, we hear the account of the captain of die puzzled 
airliner 


R o utine flight from ABC , tn bound ferns the test to XYZ / 
PIC. Prior to tacking inbound fix, we calloKTC to 
ask advisory about North-South traffieoeting in font of 
us beyond the fix.At though we am supposed to set other 
traffic now and be our *own little air traffic codfcr* in 
fret flight, the TCAS display has too small a range to 
provide a good overview oftrajfidknyway, A TC reported 
heavy waves of traffic to the north as well as south of our 
intended track pm fix to XYZ Ota the day before our 
flight . one of our air planes flying the zomwju* had 
experienced combination of turbulence and many RA's due 
ta this ensuing traffic. Upset of air aft caused one 
passenger injury We wen emtted Into chief pilots office 
befom ABC depart ue and wet told to da whatever we 
could to avoidecurunce. 

We decided to wait for the waves ofdming traffic to pass 
befom we would cots the fix. exit fir ee flight ond go into 
XYZ ATC said that was fine: we comid hold befahefix if 
we wanted However ATC also advised us of traffic at 
4 O’clock high. Wh wear not told whether this traffic was 
inbound for the samefixAtso, were tn IMC. so could not 
get visual on the traffic . TCAS did not show traffic either 
nnee ti was over our right shoulder somewbdbhen we 
tried to calk TC to clarify we could not get dough: the 
channel was congested The fix was guile near new we 
needed to act: to our south u mKXX ranges, so we could 
only turn right, 5 miles befae the fix I started the turn 
unable to concur witBTC re. other traffic About quarter 
into turn we gat an RAleUing us tedescamd. Impended 
immediate!* and also aborted our turn. White flying 
ou tboundfumfU in northeasterly dberion. A TC finally 
came hack on and totd us we had Just turned into the other 
traffic ; which had descended tasked* fix. We must have 
come pretty close: the treffk symbol on our TCAS was 
suddenly very doe* to our asreft. 



We we* vectored in over fix behind other traffic. By now 
most c mssing traffic had deed so no RA 's or delays 
getting into XYZ. 

/ don't blame conoiler for lack of help or vigilance, after all 
we wear in free flight But some revision ofptocedue of who 
exactly ts in cental a ter rcMvistf and acting on an advisor v 
seems very necessary so me. 

Apparently the inctdtnl spa rked enough concern everywhere, 
for we received s report from the other involved aircraft as 
well. This is the captain (WF) reporting; 

On a fear cud* mute westbound, dbctfmm EFC, mostly m 
free flight west of Missis tipi. Reported estimated arrival turn 
over inbound fix for destination ATC, and said wed idee to be 
over fix at FL240. They said okapStmrted descent tawMfix JO 
miles out. still m fire* flight As always, we wem ftght on fuel on 
thisfileht . even though we fly goat dak mutes now Head 
office has deoeed that we rake off with less fuel to sa ve weight. 
Result is that cannot off Many diversions along wafo we 
were counting on straight in amt fix. 

While nearing fix, we head at her * draft ahead of us asking 
ATC if it's okay to hold be for fix l Didn't seem to get a epty , so 
we thought we wee safe. Kept on going . W wem very 
surprised to suddeatpmtve an RA to climb t the last thing we 
wanted to do given ourfuel situation ); appaty, the other 
aierafi had begun to turn on a makeshift holding pattern east 
of fix end was now turning right into us. First officer and lever 
both not expecting this and not happy with it. Wven r late 
meeting to the RA and I guess we tame close to the abaft 
turning in font of us. 


Confusion shout who is in cfcmi while an aircraft is Ktai 
upon an advisory under free flight can be potcmiaUv 
dangerous, an our reporters found ouJBso. cmeatng free 
fligta traffic remains a concern for ihoee who have lo weave 
through it to get to their destination. Somehow* does not 
seam vny efteseat after all that they have lo pay the price, 
moady to the benefit of the aircraft that are ts cruise. 
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2.2.5 The Scenarios: Role Playing in Cognitive Walkthroughs 

In the cognitive walkthroughs, incidents that might occur and problems that might 
arise in a future Air Traffic Management (ATM) system are used in a different way. 
In these cases participants are given the background and context of a scenario and 
the rules under which the ATM system is operating. They are presented with the 
onset of an event and are then asked to "play out" the scenario as it occurs. The role 
playing is supported by a gaming board that represents the aircraft in particular ATC 
sectors. The participants can manipulate the gaming board to play out how the 
situation could evolve given different contingencies, actions, and interventions. 
Multiple participants debate among themselves different strategies for handling the 
situation. The methods by which they jointly resolve the problem are the data of 
interest. (See eport no. 5 in this volume for a discussion of the background and 
results of this study.) 

2.2.6 Basis for Walkthrough Scenarios 

Cognitive walkthroughs were carried out to examine how controllers would 
perform in a management by exception role. Each walkthrough presented a 
developing air traffic situation and included a set probes to challenge the 
participants based on the gaming area described in section 2.2.2. The probes varied 
to focus on different cognitive demands that could arise for an air traffic manager 
operating in a kind of free flight environment such as detecting or anticipating 
exceptions and adapting type of control to resolve problems. 

2.2. 6.2 Walkthrough 1: 

Goal: Investigates whether immediate aircraft history and flight plan is sufficient 
for a manager to follow aircraft intent and to anticipate trouble. 

Brief description of the scenario : While an incoming stream of free flight traffic 
inbound for SFO is about to start crossing over OAL, an aircraft (AW235) enroute 
from Portland, OR to Phoenix, AZ is between FMG and OAL, cruising south- 
eastbound. This airplane is squawking code 7600 on its Mode A transponder. 1 It is 
headed orthogonally for the incoming stream over OAL. Maneuvering the 
incoming traffic out of the way is constrained because of restricted airspace over the 
Tonopah military ranges to the South. 

Probes: Two sources of information about aircraft intent (velocity vector and flight 
plan) are isolated for use by the air traffic manager in this case. AW235 is unable to 
display or transmit intent in any other way. 


1 Squawking 7600 means that an aircraft has suffered a communications failure: if the squawk is 
transmitted on Mode A, then Mode C may also be inoperative. Other aircraft interrogating this 
aircraft's transponder may see this airplane represented on their collision avoidance display, but they 
will not know its altitude, and their TCAS will be unable to issue them resolution advisories as a result. 
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2. 2. 6. 2 Walkthrough 2 


Goal. To examine how air traffic managers can intervene (a redistribution of 
authority) to resolve a problem. In particular, the case looks at a strategy where 
managers take only a few aircraft under positive control while other traffic reroutes 
around, or receive clearances for entry into that portion of airspace. Three variants 
of this case were developed to instantiate different conditions which might 
challenge this strategy. & 

Method: a cognitive walkthrough of three problem-solving situations. 

Brief description of the scenarios: In order to prepare for their roles and play by the 
same rules during the walkthroughs, controllers were given a 1997 future excerpt 
from their controller's handbook, while pilots were presented with a 1997 future 
Advisory Circular (see pp. 26-34). These documents explain the specific rules of the 
RTCA strategy of declaring a portion of airspace under positive control to deal with 
exceptions (based on material from the RTCA 1995b vision of free flight) and forcing 

other traffic to reroute around, or request permission to enter into, that portion of 
airspace. 

1) In the first situation, incoming traffic bound for SFO is no longer required to 
cross over OAL to exit free flight airspace, so it is scattered over a broader front, 
approaching the free flight boundary. This boundary, however, is enveloped in 
thunderstorms building up over the Sierra Nevada. 

2) Here, free flight traffic to and from LAX, crossing over the stream of controlled 
traffic into SFO, encounters severe clear air turbulence (CAT) and starts 
descending into the arrival stream. 

3) Here an aircraft enroute from FMG and headed for OAL suffers communication 
and Mode C failures after announcing that it is going to go east of course in order 
to avoid thunderstorms building up over the Sierra Nevada. 

Probes: Rules on how to declare a portion of airspace under positive control (and 
forcing reroutes around or clearances for entry into the portion) were disseminated 
to the participants. 

In problem variant (2), free flight traffic did not have to cross over a particular 
waypoint (OAL) to exit free flight airspace; it could do so anywhere it pleased. 
Although imposing possible difficulties, this allowed a clearer funneling pattern to 
emerge in the case of thunderstorms. 

The prerequisites for the intervention strategy (i.e. what is required to make it 
possible to declare a portion of airspace controlled and ask other traffic to reroute 
around or enter only with a clearance) were instantiated in terms of time available 
to prepare a portion of controlled airspace and notify all agents, and in terms of the 
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clarity of the delineation of that airspace. These characteristics were varied over the 
three problem-solving situations as follows: 

1) Thunderstorms : some advance warning (of thunderstorms cropping up and 
traffic headed for the area), and relatively fixed dimensions. Traffic pattern can 
be recognized (because of funneling) and may be familiar in that particular sector; 

2) Clear Air Turbulence : more advance warning (after the first few free flight 
aircraft have descended into the arrival stream, it becomes clear that this is a 
problem that will affect every free flight crossing aircraft) and of fixed 
dimensions. Traffic pattern of descents can be recognized and may be familiar to 
controller in that sector; 

3) Communications failure : no advance warning (of the failure); undetermined 
and uncertain dimensions of portion of airspace (unknown where aircraft may 
go), and no recognition of a pattern possible. 

In addition, the three cases differ in the type of traffic pattern they can produce. In 
variants 1 and 2, traffic patterns can emerge and be recognized. This is not so in the 
third variant. 


2.3 Data Collection Sessions 


Session I 

Session III 

Participants 

Participants 

2 controllers 

2 pilots 

1 pilot 

3 dispatchers 

1 dispatcher 

Techniques 

Techniques 

Knowledge Elicitation 

Knowledge Elicitation 

Future Incident Reports 

Future Incident Reports 



Session IV 

Session II 

Participants 

Participants 

4 controllers 

3 dispatchers 

1 pilot 

1 pilot 

Techniques 

Technique 

Cognitive Walkthroughs 

Knowledge Elicitation 

Knowledge Elicitation 

Followup Sessions 

Techniques 


Cognitive Walkthroughs 

Structured Interviews 


Figure 5-4: Data Collection Sessions using Conceptual Walkthrough 
and Future Incident Techniques 
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We brought together different specialists with different perspectives within today's 
air traffic management system for four data collection sessions (see Figure 5-4). The 
specialists included pilots, controllers, dispatchers, and air traffic managers in 
different mixes for the various sessions. In each session we used one or more of the 
conceptual walkthrough techniques in presenting concrete scenarios to guide the 
participants' exploration of possible future ATM worlds. Each technique varies in 
the kind of procedure followed (elicitation, review of a future incident report, 
cognitive walkthrough of a future scenario). The four data collection sessions were 
followed up by discussions with other individual practitioners to clarify or expand 
on results from the group sessions. 

The reports brought together in this volume represent the results from using these 
techniques in the different data collection sessions. Some of the reports are based on 
the results of using a single technique in a single session (e.g.. Report no. 3 is based 
on the knowledge elicitation technique using the scenario probes described in 
section 2.2. 1.2). Others are derived from integrating results gathered with a single 
method across sessions (e.g.. Report no. 4 uses the future incident technique and 
focuses on results from one session, but parallel results were obtained in other 
sessions). Finally, other reports are concerned with themes based on data integrated 
across multiple techniques and sessions (e.g.. Report no. 5 on management by 
exception, and Report no. 7 on communication and coordination). 
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3.1 Introduction 

This report describes the results of a knowledge acquisition session involving 
the supervisor for air traffic services and two dispatchers from a major 
airline. The purpose of the session was to use a scenario based on experiences 
with the expanded National Route Program (NRP) in order to elicit the 
knowledge and views of these practitioners regarding areas for improvement 
of the expanded NRP and for developing new Air Traffic Management 
(ATM) initiatives in the future. 

The improvements discussed fall into six categories: 

1. Changing procedures within the ATM system so that the airlines have 
more flexibility in making choices based on their business concerns; 

2. Providing better feedback to guide decision-making; 

2. Improving information exchange and decision support tools; 

3. Providing better training to improve utilization of the National Airspace 
System (NAS); 

4. Increasing system capacity; 

5. Dealing with organizational bottlenecks; 

6. Supporting shifts in workload resulting from new roles and 
responsibilities. 
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The report ends with a consideration of some of the issues that must be dealt 
with to ensure safety and effective overall use of system capacity, with an 
emphasis on the role of the ATM system as a "referee". 


3.2 Methods 

The goal of this knowledge acquisition session was to elicit knowledge and 
insights from airline AOC staff about current and future ATM system 
initiatives. In order to generate discussion, a number of scenarios were 
presented to the participants based on actual experiences with the initial 
implementation of the expanded NRP. These observations were based on 
previous research conducted by Smith, McCoy, Orasanu, et al. (1995). The 
rationale behind this choice of scenarios was that the expanded NRP 
represents the most significant attempt to date by the ATM system to provide 
the airlines with increased flexibility to make decisions about selecting routes 
for flights based on their business concerns. Consequently, experience with 
that program offers the potential to provide insights into the issues that need 
to be considered in making decisions about the design of the ATM system in 
the future. 

3.2.1 Subjects 

Three highly experienced air carrier dispatchers took part in a six-hour 
knowledge elicitation session. The session was guided and moderated by 
members of the research team. 

3.2.2 Procedure 

This data collection session was held in February of 1996. The format for the 
meeting was as follows: 

• Allow participants to read the scenario prior to coming to the meeting; 

• Ask participants to be prepared to identify other types of important 
incidents/ observations that should be included in discussions. (The 
scenario as described below dealt primarily with observations from the 
first 6 months after initiation of the expanded NRP.) 

• Run through the list of observations and for each ask: 

- Is this an example of a real concern or improvement? 

- How significant is this concern or improvement? 

• Discuss additional incidents/observations that should be added to the list; 

• Run through the list of observations a second time and for those that have 
been rated as most significant ask what can we learn from them to guide 
us in designing the future air traffic system. 
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Below, short scenarios are presented in the form of actual observations about 
system performance during the initial implementation of the expanded NRP. 

3.2.3 Instructions to Subjects 

The goal of the short observations or scenarios described below is to focus 
attention on preflight planning at the airlines, and on the implications of 
such planning for air traffic management and air traffic control. These 
scenarios will be used to begin to address the following questions: 

1. What rules and procedures should be adopted to govern the behaviors of 
the airlines and the Air Traffic Management (ATM) system during preflight 
planning activities? How will these rules and procedures deal with current 
concerns? Will they create any potential new concerns? 

2. What rules and procedures should be adopted to govern the behavior of air 
traffic (including DoD, general aviation and commercial aviation traffic) and 
the actions of air traffic managers while flights are enroute in order to allow 
them to deal with situations that may arise as a result of the rules governing 
preflight planning? 

3. What roles and responsibilities should be assigned to different individuals 
at the airlines and within the ATM system? What training is necessary to 
ensure effective performance in these roles? 

4 What services should the ATM system provide to the airlines? 

5. What information should be exchanged between the ATM system and the 
airlines (both real-time and historical information)? 

6. What technologies need to be developed to effectively support these roles 
and responsibilities? 


3.3 Scenario Overview 

(This scenario set is summarized in report no. 2 of this volume, pp 2-11-13.) 
These scenarios are based on the ATM system as it existed from January 9, 
1995 to December 31, 1995. (During the discussion, additional observations 
will be added based on more recent experiences.) It should be noted that 
during that time period the ATM system was operating under a hybrid rule 
structure, with a number of advisory circulars and orders in effect, including 
FAA Advisory Circular 90-91 as well as the order for the expanded NRP. 

The basic question raised by these scenarios is: What can we learn from 

experiences that arose during the initial implementation of the expanded 
NRP, in order to guide us in future decisions about the design and 
implementation of the ATM system? This includes future decisions 
regarding the roles and responsibilities of the various people and the 
technologies embedded in such a future system. 
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3.3.1 The Scenarios 


The order for the expanded NRP took effect on January 9, 1995. This program 
was phased in at progressively lower altitudes over the following twelve 
months. Advisory Circular 90*91 had been in effect for several years at that 
point. 

To produce this scenario, we have documented a number of issues and 
situations that arose during that time period (some represent improved 
system performance, while others represent new or continuing problems). 
These issues and situations are described below as a set of observations, 
supported by anecdotal information elicited from their sources. 

Observation 1. Data from one major airline indicated that the increased 
flexibility in flight planning provided during the first three months under the 
expanded NRP allowed its dispatchers to file flight plans with the potential to 
improve fuel efficiency on average by about 2.5%. 

Observation 2. TMO: "The MAR program and the NRP program have been 
beneficial in a way. They have shown us a lot of places where we might have 
been a little comfortable. I’ve seen a lot of places where they've cut away 
some of the fat out there. We’ve almost eliminated our miles-in-trail 
restrictions at Oakland Center, for example. But I think we've reached the 
level we can handle with the technology we have today." 

Observation 3. The expanded NRP gave the airlines more flexibility and 
control in selecting the routes for certain flights. It did not provide the 
airlines with any increased flexibility as far as ground stops were concerned. 
An example illustrating this is the following: 

On a particular day, the ATM system predicted that San Francisco would only 
be able to accommodate 50% of its normal arrival capacity in 3 hours (from 
10-11 am) due to bad weather. Ground delays were therefore initiated for a 
number of flights at various airlines. The meterologists for one such airline, 
however, believed that there was a significant chance that the weather at San 
Francisco would clear before 10 am. Given that internal forecast, and given 
that the flight could be diverted to Oakland if the weather didn't clear, the 
responsible dispatcher concluded that it it would be preferable from a business 
perspective to launch a flight from DFW to SFO that was being held because 
of the ground delay program. The ATM System did not accommodate this 
request. 

Observation 4. Because of a closed runway, the arrival rate into LaGuardia for 
the next 3 hours was restricted to 75% of the normal rate. ATCSCC put a 
ground stop program into effect, holding a number of flights at other airports 
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on the ground. Several affected airlines wanted to substitute some of their 
delayed flights for others that were still scheduled to leave on time, as these 
delayed flights were much more time-critical in terms of passenger loads and 
connecting flights. The ATM system had no easy mechanism to 
accommodate this desire. 

Observation 5. Traffic from the west into the northwest cornerpost at Chicago 
was very heavy. Consequently, this traffic was being sequenced to ensure 
efficient landings at O'Hare. When one airline wanted to file a flight from 
Minneapolis to Chicago, rather than simply telling the airline that the flight 
would be delayed for 20 minutes on the ground, the ATM system gave it a 
choice: "You can take a 20 minute ground delay and then be assured that you 
can be sequenced into the flow at the northwest cornerpost, or you can take 
off now with a 20% chance of being fit into that sequencing and an 80% 
chance that you will be vectored to the northeast cornerpost instead." The 
airline decided for business reasons to go ahead and launch the flight. 

Observation 6. The expanded NRP raised certain concerns at some (but not 
all) Centers. As an example, one challenge arising from the expanded NRP 
was that airlines sometimes wanted to cross their high altitude flights over 
departure and arrival routes. For instance, for certain flights over the top of 
O'Hare, Chicago Center had always preferred that the traffic be routed over 
Badger in order to avoid having enroute traffic cross the departure lanes. One 
airline, however, preferred (and was now been filing) these flights over Iowa 
City-Waterloo under the expanded NRP. Such flights criss-crossed through 
the departure lanes, creating a "very tricky, complex operation" for ATC. This 
raised an interesting question: Do you let 3 or 4 planes cross at the cost of 
slowing departures by about 20%? This tradeoff was particularly interesting 
because such flights were most often slowing departures from Chicago of 
flights by two other airlines. 

In contrast, at Oakland Center such criss-crossing traffic through arrival lanes 
is being allowed, but not without significant concern: "We're seeing a funnel 
effect. Where it used to be we would have 2 streams down to the Los Angelos 
basin, now everybody aims for Avenal. This works ok a lot of the time, 
except when things go wrong. When they go wrong, you suddenly have a 
whole herd of airplanes pointed at one point and a last minute change such 
as the need for an increase in the miles-in-trail or an airplane taking a wrong 
clearance, or any number of things, can cause a serious problem because you 
have a real concentration of airplanes. Suddenly you have to pull the plug to 
deal with it, whereas before at most you had a miles-in-trail situation, you 
had a bit more leaway. Even when it's workable, it puts a burden on the 
controller because it's not something they do every day." 

"If you just take those aircraft crossing Coaldale at 39,000 feet, they've got to 
cross Modesto at 24 and you've got airplanes southbound at 29, 33 and 37, 
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northbound at 31, 35. It's pretty much like a charge. It makes it real hard to 
thread that guy from 39 down to 24 and at the same time do all the things you 
have to be doing, [f it was just one airplane to get through anybody could do 
it, but we re talking multiple airplanes, because it's the old push time and 
they're all coming at once. Twenty minutes later there may not be an 
airplane in the sector, but for those 20 minutes it gets wild and crazy. Not 
having them on the routes the way they used to be has caused a lot of 
heartburn for the controller. They're having trouble getting them down." 

Another concern introduced by the expanded NRP was due to the instruction 
to give preference to NRP flights. As one TMO stated: "It gets cumbersome 
because the NRP program says you're not supposed to touch them. So we 
have to move 3 or 4 other airplanes to solve one problem. They (the 
Command Center] encourage you to move other traffic to leave the NRP 
traffic alone." 

A fourth example that arose as a direct result of the expanded NRP at some 
airports, and also as a result of an increased numbers of direct flights, had to 
do with balancing of loads at cornerposts: "If we get a jetstream right out of 
the southwest part of the country, everyone rides it (into O'Hare). 75 percent 
of these airplanes are all coming in at the southwest cornerpost, creating a 
major volume saturation point. The old solution was to create a delay 
program to avoid launching too many flights into traffic, for example creating 
20 minute delays at an airport, and to increase capacity by moving half a 
dozen flights to the northwest cornerpost. Under the expanded NRP, 
controllers were not allowed to use the latter solution. Controllers had no 
way of policing those flights, because if it said NRP it meant they were not 
supposed to reroute them. They were supposed to leave them alone." 

A similar situation arose as a result of flights filed by a single airline which 
"had 5 flights which originated in the LA Basin, PHX and LAS. When they 
were all filed to the Soutthwest cornerpost at DTW during certain arrival 
banks, the result was an overload at that fix. We responded by moving a 
couple of those flights, or other flights originating in Florida, to another fix. It 
would have been cheaper for that airline to file some of them to that other fix 
to begin with." 

A sixth example of an issue associated with the expanded NRP concerned 
what was happening when there were arrival rate restrictions (due to 
weather, etc.). For instance, in one case Kennedy had set a reduced arrival 
rate of 50 percent at 2 p.m. because of the weather forecast. To deal with this, 
Chicago Center began limiting flights bound for Kennedy that were flying the 
standard preferred routes. In addition, however, there were flights filed 
under the expanded NRP that were not limited. The net result was that the 
capacity for Kennedy was exceeded, with many planes "winding up in high 
altitude airborne holding, and that's a major problem." 
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Finally, holding itself has become more difficult: "If they do go into holding, 
you might not have these airplanes anywhere near the fix you have to hold 
them at. You have to pull them in from all corners of the sector, where 
before they'd all automatically be going over this point and all you had to do 
was issue a clearance and watch for the altitude. Now you've got to transition 
people all the way from the north and south to a common point and probably 
start doing a lot of altitude juggling at the same time." 

Observation 7. At certain Enroute Centers such as Chicago and Cleveland, 
numerous examples were noted where new problems with air traffic 
congestion arose. It is important to note, however, that many of these 
concerns did not arise because of the preflight plans filed under the expanded 
NRP. As one TMO reported: The source of the major concerns was not the 
expanded NRP per se; it was the spin-offs of the expanded NRP, such as the 
increase in direct routes that were filed while flights were enroute. The 
impact was that flights were now going direct through sectors where they had 
not done so in the past. The major change in air traffic patterns wasn't due to 
flights filed under the new expanded NRP itself, as fewer than 5% of the 
flights were being filed under the new expanded NRP. It was due to this spin- 
off of the expanded NRP. 

Specifically, once airborne, pilots were requesting and getting clearances for 
direct routes from controllers, who were clearing them on these direct routes 
without any approval from the affected sectors. This was apparently 
interpreted by these controllers as the "Free Flight" concept. (The actual order 
for the expanded NRP contained no such instructions.) The result for 
Chicago Center, for example, was that they were inundated with direct routes 
on the south side of the Center, in sectors that in the past had not been 
impacted by such traffic levels. 

There was also a problem with the unpredictability of traffic loads from day to 
day. As an example, the flights to Newark were now coming through 
Chicago on various routes, often through different sectors on different days, 
depending on the winds. As a result: "One day a controller is inundated, the 
next day he's twiddling his thumbs." As one TMO put it: "The whole 

concept of traffic management is we don't shotgun any one controller. The 
guy who is working the initial point of the arrival, like Little Rock going to 
Blue Ridge arrival, we're now pointing a shotgun at his head and saying: 
'Here come the airplanes'. Before, we had a structured flow into those fixes. 
Each time we melded 2 or 3 lines, a different controller was doing it, so finally 
we got down to one line. Our big fear now is a possibility in Memphis of a 
single controller having 3 of those points in a sector, so we're shotgunning 
him 3 times." 

In terms of the magnitude of this problem, 70 to 80% of the flights over many 
Centers were now on direct routes. For some Centers, such as Kansas City 
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and west, this wasn't a major problem. For others like Chicago and east, there 
was a significant impact. Some aircraft had to be held at the Chicago Center, 
Cleveland Center, and Indianapolis Center boundaries because sequencing 
the resultant multiple flows became nearly impossible. 

Observation 8. Another potential challenge was a concern with commuter 
flights. With aircraft like the Challenger jets, "they want to go to 37,000 feet." 
How will this traffic be handled if they start to take advantage of the expanded 
NRP? K 

Observation 9. As indicated above, pilots as well as controllers contributed to 
this sudden increase in direct flights. Pilots (with the permission of 
controllers) chose to fly direct instead of flying the route selected as "optimal" 
during preflight planning. 

Below are two examples of this: 

A dispatcher was riding jumpseat on a 757 flight from EWR to LAX which 
had been filed under the NRP by the dispatch staff. ATC offered the flight 
direct from EWC to PWE (south of the user preferred trajectory as determined 
during preflight by the dispatch staff). The Captain looked at the dispatch- 
provided data, which showed that this direct route would cost additional time 
and fuel. Nevertheless, because the FMS gave different data than the ground 
computer, the pilot chose to accept the offer of a direct route. The result was 
added time (4 minutes) and fuel bum (500 lbs.). (In order to make up the time 
they were losing 2 hours later, the flight changed its flight level and cruise 
schedule, which increased its overburn.) The flight also went through a 
convective sigmet with tops to FL 450 that they would passed to the north on 
the original route. 

Another example was a flight that flew from DFW direct to Parker. The 
responsible dispatcher commented: "If a direct route had been better, I would 
have filed it through the NRP. I had planned it over Albuquerque because of 
a favorable southerly jetstream. Flying direct to Parker, the flight was flying 
directly into the jetstream. The plane was 6 minutes late." 

A contributing factor in examples like the second one above appeared to be a 
lack of awareness by pilots as to when they were on an NRP flight plan. 
Interviews with pilots from several airlines indicated that they did not know 
when they were flying a flight plan filed under the expanded NRP. 

Another example was even more extreme. As noted above, a by-product of 
the expanded NRP was a sizable increase in the number of direct flights 
approved while enroute. One of the pilots interviewed from a major air 
carrier indicated that he thought "that was what the expanded NRP was all 
about", that when a controller now offered him a direct flight, ATC and the 
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AOC had jointly determined that a direct flight was best for him in terms of 
weather and air traffic. His comment was: "I was tremendously impressed 
that they could achieve such coordination." (The reality was that such offers 
for direct flights were completely uncoordinated — the controllers weren't 
even checking with the other affected Centers, let alone the airlines, regarding 
the impact of such direct flights.) 

Observation 10. A Dispatcher had a choice between filing a flight from LAX to 
DFW either north or south of White Sands. The northern deviation offered 
the shorter wind route. While enroute, however, the flight was rerouted to 
the southwest cornerpost because of traffic congestion. As a result, the flight 
burned substantially more fuel and was later than it would have been if it had 
originally filed the southern route to the southwest cornerpost. 

Observation 11. A number of airline dispatchers and ATC coordinators were 
completely unaware of the dramatic increase in direct flights that occurred 
following the implementation of the expanded NRP (even though flights 
from their own airlines were involved). 

Observation 12. The system for requesting non-pref routes through ATCSCC 
under the old NRP (Advisory Circular 90-91) provided an example of how 
procedures can be established to encourage the distribution of knowledge to 
relevant participants in the flight planning process. As one airline ATC 
coordinator stated: "When we started this [the procedure for requesting non- 
pref routes], even Central Flow didn't know where all the choke points were. 
But as we pressed the system and said 'now we want to fly over here', we'd 
call the Albuquerque Center and they'd say: 'You can't go eastbound over St. 
John at 4 o'clock in the afternoon.' Well, that was tribal knowledge in the 
Albuquerque Center. The tribe expanded to include Central Flow; Central 
Flow expanded the knowledge to the airlines and we [the airlines] began to 
build better routes. So rather than having to fly a 2000 mile route because it 
didn't work at one point, we began joggling around and making routes that 
were smarter. ... Originally, we'd call and they'd say no. But then it became: 
'Well, if you would just do this, if you'd just make this minor adjustment in 
your flight plan, we could probably do this. It became a much more 
collaborative effort." 

Observation 13. In contrast, 6 months later, after the start of the expanded 
NRP, this same ATC Coordinator noted: "The problem with the expanded 
NRP is that there's no feedback to the AOCs. Nobody's getting smarter. ... 
When we went to free flight on Jan. 9, we cut off the feedback loop for those 
flights filed under the expanded NRP. ... How do we get this local knowledge 
that theTMUs and controllers have out there for the dispatchers and pilots? 
... There are problems in the ATC system that I don't know about. I need a 
mechanism to get feedback. ... How do we give the airlines more timely 
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information? Depending on where they're going on which day, how do we 
get the information to everybody? How do we all get the same picture?" 

Observation 14. The assumption behind free flight is that "if the airlines 
create a bottleneck and for 3 days in a row they get delayed, they'll change. 
They'll change the departure time or file a different route. Under free flight, 
we're leaving it up to them to find a solution." The assumption, in other 
words, is that free flight represents a "free market" environment in which 
businesses will respond to problems in order to remain competitive. Upon 
implementation of the expanded NRP, however, new problems arose that 
resulted in consistent inefficiencies for certain flights. The airlines were often 
very slow to respond, taking weeks to recognize and react to such problems. 

Observation 15. TMO: "We don't even get a listing of who flew NRP the day 
before so we can review it and see what are the trends." 

3.4 Results and Discussion 

This data collection session elicited a wide range of results that are of 
potential value in guiding future directions for research and development. 
These are outlined in the sections below. 

3.4.1 Benefits Associated with the Implementation of the Expanded NRP 

On the whole, the AOC staff for this airline were very positive about the 
impact of the expanded NRP: 

• "I think it's paid some big dividends for our airline and the whole 
aviation system." 

The basis for this assessment is data such as the following, which indicate the 
level of usage and the estimated savings from the use of the expanded NRP 
for one month by this airline. For example, during that month, the airline's 
ATC Coordinators requested a total of 459 NRP routes through ATCSCC, and 
260 of these were approved for filing. An additional 2355 flights were filed 
under the expanded NRP by the responsible dispatchers. Thus, there were a 
total of 2615 flights filed under the NRP. (In this airline, ATC Coordinators 
handle any requests for NRP routes through ATCSCC, while the dispatcher 
responsible for a flight is in charge of filing it under the expanded NRP if 
desired.) 

The 260 flights filed through the Command Center were estimated to save 
$55,160 in time (estimated at $40/ minute saved) and $14,218 in fuel (at $0.58 
per gallon), while the remaining 2355 flights saved $339,880 in time and 
$94,060 in fuel. 
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3.4.2 Areas for Improvement 

The ensuing discussion did, however, lead to a number of suggestions for 
how to either further improve upon the expanded NRP, or to develop new 
programs that provide the airlines with additional flexibility to meet their 
business needs. 

3 . 4 . 2. 7 Flexibility 

In terms of a desire for greater flexibility, one concern is that the expanded 
NRP applies to only a subset of the routes flown by this airline: 

• "There are all kinds of other routings that we are mandated to fly and 
we have very few options. We have really fewer options in those 
markets than we do in the markets with preferred routes." 

In particular, this airline flew only about 500 flights per day that met the 
guidelines for the expanded NRP at that point, out of a total of 2690 flights. 
(Many of these additional flights are too short to be covered by the official 
preferred route system. Nevertheless, many of them have routes constrained 
by the ATM system.) An example of one of these other highly constrained 
routes is: 

• "Stewart-Newburg to Atlanta. We are required to come out of Stewart, 
north over Weard Intersection into Boston Center, back in over Lake 
Henry and Phillipsburg, New York Center, into Cleveland Center, then 
back into Indianapolis Center and back into Atlanta Center. 
Sometimes we get into Washington Center, sometimes we go through 
six Centers to get there. Nobody wants us in any of those areas. We've 
been trying to deal with New York Tracon to take the flights across 
TRACON airspace, which we think is much more efficient. They have 
their own problems, but we have flown that route for 4 or 5 years, 
which is 60 or 70 miles further than we want to go and in the wrong 
direction. So, although that is not a published ATC preferred route, we 
have no flexibility in what we can do and what we can't do." 

A second concern is the 200 mile constraint imposed by the expanded NRP, 
limiting flexibility (for the first 200 miles and the last 200 miles of a flight) in 
planning economical routes: 

• "We would like to see more work to do away with the 200 mile 
regulation. That would give us a lot of flexibility." 

A third concern deals with groundstops and delays. The expanded NRP 
provides flexibility in the routing, but not the launching of flights: 


3-11 



• "Where we get into problems is with program delays. Half an hour 
here, 45 minutes there, because the arrival rate is reduced in a city. 
That's the kind of thing where we would rather launch and keep the 
pressure on the system up there and make them land us, rather than 
have gaps in there and be 45 minutes late because they held us at the 
gate." 

A fourth concern is prioritization: 

• "If you're going to divert 3 of out 12 flights to Newark, we want to tell 
you which 3 we want to go. We don't want you to tell us which 3." 

Regarding prioritization, however, there was a recognition that there are 
additional concerns that make it infeasible to respect the airlines' economic 
concerns: 

• "A lot of times ATC has no choice. You may be at 10,000 feet and I may 
be at 20,000 feet. Or the flights may be coming in over different fixes." 

A fifth concern is a desire to take advantage of variable speeds. Like the issue 
of prioritization, this issue requires enhancements at the airlines and within 
the ATC system: 

• "Another consideration is the ability to slow airplanes down or speed 
them up. We are already doing that to some extent. In fact, our new 
flight planning system will be based on that." 

• "As an indication of its significance, we just got a little blurb saying that 
our systems analysis staff identified 600 flights the other day that were 
available to slow down a little bit because they were estimated to arrive 
10 minutes early because of the winds. We weren't able to slow any of 
them down in part because the ATC system doesn't like us slowing 
them down." 

• "No, they like .80 and they like .80 for everybody." 

• 'They do, and they recognize an airplane as a certain speed, or 
operating at a certain speed. And we try to operate at that speed in the 
terminal area, in the arrival and departure areas. Enroute, however, I 
think you should be able to get away with slowing down or speeding 
up. If you're in line for arrival with everybody else and you slow 
down, obviously everybody behind you is going to have to do that. 
With current technology, ATC doesn t like that." 

A sixth concern is runway assignment. Solutions again would require 
changes within the airlines as well as the ATM system: 
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• "As dispatchers, we don't really get involved in ground operations that 
much, but that's one of the real big cost items that we have. Taxi times, 
landing on runways where the plane has to taxi a long way, I think that 
we need to look at that in more detail than we do." 

3.4.2. 2 Feedback 

The participants also suggested that, in terms of internal airline operations, as 
well as for overall program evaluation, there was a need for better data 
collection and evaluation: 

• "We suffer from not really having a method to track what we are 
actually doing. We know what we plan. We know what savings we 
expect from what we plan, but we haven't really come up with good 
ways to determine if we're really achieving that." 

There is a similar need to provide better immediate feedback to help 
individual dispatchers modify flight plans on a given day and to learn in 
order to make future improvements: 

• Moderator: "What do dispatchers know about what resulted from the 
expanded NRP?" 

• Dispatcher: "If I’m not too busy doing other things, I might glance at 
my graphical screen to see where everything is, but if I don't do that, I 
really don't know what's happened to a flight unless the pilot calls. 
You know you've tried to plan the flight the most economical way. If 
they haven't called you, you don't really know whether they are on 
that route or whether they have changed the route but have chosen 
not to call you." 

3. 4. 2. 3 Computer Support and Information Exchange 

There are a number of areas where dispatchers, pilots, traffic managers or 
controllers need better tools to make better use of the NAS. 

Flight planning tools. One area where improvements are needed is in the 
design of flight planning systems that fully take advantage of the flexibility 
offered by the expanded NRP: 

• "We are limited by our computer system. We still are limited in filing 
land-based nav aids. We do directs in between them, but we don't 
have the capabilities of doing Lat-Longs. I see some very big benefits in 
doing that. We re hoping to have a system at some point in the near 
future that will allow us to do that. Right now, however, we're still 
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filing VORs, maybe directs in between them, but that still requires you 
to do a certain amount of zig-zagging instead of using the optimal 
profiles." 

Enroute flight management tools. A similar problem arises for flight crews 
while enroute. When offered a direct route by ATC, they have no accurate 
source of information onboard in order to compare their current route with a 
direct routing. Even if they do talk with the dispatcher: 

• "It's a very cumbersome task for the dispatcher to give them direct 
numbers. It's unfortunate. You actually have to insert the route one 
piece at a time. We also run into problems because, if it exceeds 900 
miles, you're getting an average wind in the middle. You may think 
that you're getting some good information, but in reality you're not." 

Information on special use airspace. One particular area where better 
information exchange would be helpful had to do with special use airspace: 

• "Jet 110 goes straight across the middle of White Sands, into the 
military airspace around Edwards. There is a little tiny note on the 
chart that says: 'Not available most days.' We essentially avoid it. I did 
some work with Albuquerque Center a while back and they were going 
to provide us with that information on a daily basis. We never could 
get it worked out so that we could really utilize that. It's just a small 
part of the total puzzle, but it cost us money. We file north of it or 
south of it all the time. Even though we don't have a real big 
operation in that region as compare with American, it still costs us 
money." 

3.4.2A Coordination and Information Exchange 

Experience with the expanded NRP has also indicated a need for better 
coordination between AOCs and the ATM system. One such issue has to do 
with predictability. To be effective, dispatchers need to know when Centers 
are going to reject certain routes: 

• "There are times where I will sit for 4 or 5 hours and file NRPs and 
watch Miami Center or Jacksonville Center reroute them back to the 
preferred route. They get them out of another Center and they'll say 
‘no, we want them over here,' and they'll move them over. I'll see half 
a days worth of this and then say to myself: 'This is making extra radio 
work for me, with the crews calling me back and forth. I'm just going 
to put them on the preferred route. That's what the ATC system is 
going to do with them anyway.'" 
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While some of these problems might be predicted by AOCs by looking at the 
information available on weather displays and the ASD, others clearly require 
input from the involved Centers: 


• "It may not be weather in that part of their Center. It may be in a 
different part that's compacting traffic all the way over, or it could be an 
occasion where it's just a manpower problem, where they don't have 
time to process the heavy traffic with the manpower they have, so they 
want to line everybody up and bring them through." 

• "We really don't have a good handle on the traffic bottlenecks when 
we do have problems. It all gets back to not having the data on what 
they're actually doing. We need to know how they are reacting to a 
situation." 

• "I need to know from ATC where the choke points are, where they're 
going to move somebody or where's the bad spot is today, and whether 
a bad spot today is a bad spot tomorrow. I need a forecast from ATC 
that says: 'Hey, we're compacted here, but you can have this NRP route 
all the way to there.' We need to know that ahead of time, as much as 
they can predict that for us." 

• "What we really need is an NRP forecast for the day from them. Our 
workload increases if we have to change our flight plan six times on an 
NRP route. It's an aggravation to have to go back and change every 
one of those. You've got to cancel your old strip, probably add fuel to 
your flight plan. If we had a little bit better forecast, it would help. A 
lot of times, thunderstorms in the summer are not very predictable, 
but there are obviously times when there are lines moving that let you 
get a pretty good feeling that ATC won't want anybody there today. If 
ATC could just let us know ahead of time about these cases, we'd work 
around them. But we need to know how they're going to deal with a 
problem." 

• "They don't have to pinpoint things for us. If they could just say 
'today's NRPs we prefer south of Walnut Ridge or north of Walnut 
Ridge,' then we could evaluate it from there. Or you know: 'Fly east of 
this line today, or fly west of it, that's our forecast.' We certainly can t 
hold them to that, but it would help if they would just share their 
ideas. The guys in the Center know when they're going to get hurt. It 
would help if they could just give us a clue as to when they're going to 
get hurt and what they're going to do with about it, we'd try to work 
with them on that." 

• "Right now we sometimes think we're doing something good when 
actually we're doing something bad. For example, we may be bringing 
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a flight in over a fix where they're having trouble fix balancing. 
Consequently the flight gets put into a holding pattern. We think 
we're doing an economical route when we're not. We don't have 
enough information." 

• "I don't know about how much ahead of time we would be able to do 
that, but even enroute if they are a half hour away from the big bank in 
Atlanta and they see Macey's going to be inundated, that they're going 
to have to hold six flights out at Macey, that's good information for us 
to have. Anytime I can tell the crew what's going to happen to them 
before they get there benefits us greatly. Then the flight crew is on our 
side to begin with. They're going to hold longer. They're going to be 
more comfortable with what we're telling them rather than screaming 
at us: 'How come we're holding?"' 

An important concern with such forecasts, however, is that 

• "ATC tends to be very conservative and say: 'Hey, we might have a 
problem here today so we're just going to say that you guys shouldn't 
file that today.' If they could provide realistic data when there was a 
real need to avoid something, we wouldn't do it." 

An example where this type of information exchange is happening now is 
with an "economy" route that this airline has worked out with three Centers: 

• "In our market from Atlanta to South Florida, essentially what we do 
is we fly two routes. We;ve got the preferred route and an economy 
route negotiated with Atlanta Center, Jacksonville Center and Miami 
Center because we know that it's more efficient to go down the East 
Coast than it is to go down the West Coast." 

• "It's automatically approved and they allow us to file it under most 
conditions. We do have certain conditions where we can't. If there is a 
missile launch at the Eastern Test Range, they don't allow us to file it. 
The same thing applies if there are thunderstorms. So there are times 
when they'll send us a message and say, 'go back to the preferred route,' 
and we comply with that. They usually do let us know when there's a 
problem through the Command Center." 

Shared Displays. In addition to providing information such as NRP forecasts, 
it was also suggested that there is a need to provide shared displays so that 
AOCS and ATM staff are looking at the same information when exploring 
and negotiating routes: 
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• "There are big benefits from us looking at the same information that 
ATC is looking at. We don't always interpret it the same way, but 
looking at the same product has a lot of benefits." 

3. 4.2.6 Training 

The implementation of the expanded NRP has highlighted another barrier to 
actually achieving the full benefits from air traffic initiatives: Inadequate 

training. Specifically, many pilots do not sufficiently understand the 
implications of filing under the expanded NRP: 

• "I would estimate that only 60-70% of our pilots understand the 
expanded NRP." 

The net result is that pilots frequently accept direct routings from ATC once 
enroute, even though the AOC has determined that, based on the best 
available data, the filed NRP route should be more efficient: 

• "They'll accept a lot of directs. We'll have filed them on a pressure 
pattern economy route but they think direct is always better, or higher 
is always better. We've tried to get that information out to them, but 
you know, there is a mindset out there among the pilots that we've got 
to fight against." 

• "A lot of times the flight crew will report to us on a long haul flight. 
They'll report over some point where they are not supposed to be. 
We'll call and say: 'Why are you there?' They'll respond: 'Well, ATC 
offered me direct.' When ATC says they'll offer a flight crew direct, it’s 
like holding up a $100 bill. We've caused diversions before because of 
that. They've refiled direct while enroute and gone way off the filed 
NRP route, losing the wind pattern, with the result that they are 3,000 
or 4,000 pounds short. Those flights have had to stop short and get 
fuel." 

This problem is further aggravated by the inconsistencies in the data available 
to the flight crew through their FMS and the data available to the dispatcher: 

• Dispatcher: 'They are very comfortable with the FMS. We know that 
our flight planning system is more accurate than their on-board 
system, unless they have plugged in the winds down line that are on 
the flight plan. 1 don't think that happens a whole lot." 

• Moderator: "Do you ever get into discussions where you're saying 'my 
data says this' and they say 'theirs says that'?" 
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• Dispatcher: "Oh yeah. That happens often. We may have an average 
wind component of 50 knots and they maybe just started between that 
fixed pair and have 80 or 90 knots in their face. They'll say: 'This is 
wrong.' You have to explain to them that this is an average of the 
entire [route between the] fix pair, that the wind should decrease as 
they go further. Sure enough, you don't hear from them again, so it's 
obviously what happened. They are much more comfortable with 
what they see in their own box than they are relying on us. I guess 
that’s just human nature." 

3. 4. 2.7 Other Capacity Constraints 

A number of the issues discussed above have implications for determining 
system capacity or the efficient use of system capacity. Although it was not 
the primary focus of this session, the participants did outline other capacity 
constraints of concern. First, they emphasized the critical importance of 
capacity limitations in considering future ATM initiatives: 

• "I think they should continue to look at and develop ways to increase 
capacity because that's really our limiting factor. Weather as well, 
maybe, but in essence it’s capacity." 

Relevant issues included gate and runway capacities, as well as sector and 
cornerpost loadings. One important question raised had to do with when 
such limitations are due to controller workload limitations rather than 
physical or procedural constraints. As an example: 

• "It would be nice if ATC had the flexibility where they could move 
their resources to handle different areas, rather than have four 
cornerposts, to be able to move some of those resources when they 
have a heavier demand coming in over Rome, having two controllers 
with two sectors working that area, as opposed to one. I don't know 
how that would work, but it would be nice if they could put manpower 
in that area when it's needed, with less manpower in other areas." 

3. 4. 2. 8 Organizational Problems 

Another concern raised during this data collection session had to do with 
inconsistencies in the ways different Enroute Centers deal with air traffic: 

• "There are 20 Centers out there and every Center might as well be in a 
different country, because they all have different moves and different 
regulations and they don't necessarily get along with each other. They 
have their letters of agreement (MOUs) out there that we know 
nothing about, and it’s just a big mess. I think that sometime in the 
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future, they need to think about consolidating some of those Centers 
and running them more consistently. It's a big problem." 

• "When we deal with them in one Center we'll deal with an airspace 
and procedures guy. Then, in the next one, it's a TMO and in the next 
one, it's somebody else. They don't talk to each other, so if you work 
out something in one Center, that's fine with that Center, but now 
you've got to go to the next Center and you've got to work with them. 
We need a means where we tell them what we want to do and then 
they work it out, as opposed to us trying to work out many, many 
different agreements." 

An example of the value of working out problems with several Centers at 
once was then discussed: 

• "We recently took a group from Cleveland Center and a group from 
Indianapolis Center and some representatives from their tower in 
Cincinnati, along with military representatives. We all sat down in 
Springfield, Ohio and talked about the problems we have in 
Cincinnati. They came up with solutions that were amazing because 
they had the authority to make some decisions. We came up with 
some real good things there. We came up with some new departures 
out of Cincinnati. We reduced the mileage on a lot of our routes. We 
decreased some of the runway problems we had by developing new 
departures. Those things can be done, it's just that you need to 
somehow get these groups together so that they can talk to each other." 

3. 4. 2. 9 Dispatcher Workload Problems 

Finally, another barrier to full use of the expanded NRP, and a potential 
problem with other future programs that give the airlines more flexibility, 
deals with dispatcher workload: 

• "We get into a workload problem at times. Yesterday is a perfect 
example. I had a lot of fog, flights holding in Little Rock, Richmond, 
and in and out of Florida. There was a significant savings if we filed 
down the East Coast of Florida, but there was an hour period where I 
let flights to Miami, Lauderdale and Palm Beach run on the preferred 
routing because I didn't have time to go in and look and analyze 
things. They needed the releases. I was going to delay the flights if I 
didn't get them out in a hurry, so the excessive workload stopped me 
from saving a little bit of money yesterday." 

Furthermore, since the airline is taking more responsibility when filing a 
flight under the expanded NRP (since the ATM system doesn't review such 
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flight plans for potential problems), the dispatcher routinely has a greater 
workload under this program: 

• "It's a high maintenance program. You've got to talk to the crews more 
frequently. You're taking a little bit more responsibility on yourself 
when you're filing NRP routes, so you've got a little bit more checking 
to do. If I'm going to file somebody at 35 on an NRP program, and 35 
gets bumpy, now he's got to drop down to 31 at Indy Center and they 
don't like that, so they'll want to scoot him around inbounds or give 
him a 90° turn somewhere. Then it's me that’s held accountable, not 
the pilots. It's high maintenance. I'm paying more attention to those 
flights. I'm talking on the radio more frequently." 

The importance of this extra work is further emphasized by the following 
example: 

• "If I've got a 1,200 pound savings on an NRP route , and I've reduced 
his fuel and just fueled him with minimal fuel for that NRP route and 
then all of a sudden he's switched back over to the pref route, then I'm 
taking a delay at the gate or there is a pilot who wants to stop 
somewhere." 

3.4.3 Regulation of Airline Performance in New ATM Initiatives 

A number of the points made above suggest the desirability of giving the 
airlines greater flexibility in making decisions about when to launch flights, 
how to route them, etc. In discussing such revisions to the design of the 
ATM system, however, a critical question was raised: 

• What rules and procedures will provide greater flexibility while at the 
same time ensuring safety and overall efficient use of the NAS capacity? 

The major focus of this discussion was the problem that what is a good 
decision for one airline will not necessarily always be a good decision for the 
overall system. 

Two related questions are: 

• Is a neutral "referee" required to make decisions that ensure safety and 
efficient use of system capacity? 

• How and when should that referee become involved? 

While these questions go beyond the focus of this particular data collection 
session, some pertinent insights were provided: 

• "That's where I have a problem with collaborative decision making 
and with a flow based on arrival times. When and if this ever comes 
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into effect, it will be the carrier 7 s responsibility to keep a flight at its 
departure until it believes the flight can leave and actually land at its 
destination. I think we're going to find it hard to delay departures, 
because we want to get airplanes in the air. If they get in early and 
somebody spanks our hand, well, okay." 

• "Let's say we start doing that. We wait for the feedback that we're 

having problems with our strategy for launching flights. The issue is, 
are we also cutting our safety margins? You could say: 'It's just a 

divert.' But is that changing something about the decision to divert? Is 
it saying: 'I'm going to risk hanging on a little bit longer because I really 
want to get into that airport?' We re changing the pressures on the 
people making the decisions. Where is that strictly an economic 
decision, and when does it start to be gradually more and more of a 
safety issue? Because it s not a clear cut line between the two." 

As an example it was suggested: 

• "Suppose ATC's monitoring the overall safety of the system, and let's 
say the FAA has a criterion that says that we don't want people to be 
making diversion decisions with low amounts of fuel all of the time 
since that's not a good policy from a safety point of view. They would 
have to track how often we are doing this, and if they see that a carrier 
is pushing the edge of the throughput margins, they'd have to say: 
'Wait a minute. We want you to back off on that a little bit.' How 
would that negotiation work? Do you see them coming back and 
saying to you: 'Limit your throughput.' Since they have a 
responsibility for overall system safety, how are they going to decide?" 

It was also pointed out, however, that the airlines already demonstrate some 
ability to self-regulate their decisions effectively: 

• "Don't get the impression that we don't hold flights for poor weather. 
When we're going to Dayton or Columbus or South Bend or Grand 
Rapids, frequently they'll be below minimums with no ground stop on. 
We still choose to stay on the ground. So we already do a considerable 
amount of self-regulation ourselves." 

3.4.3. 1 Alternative Control Parameters 

The discussion above suggests one (possibly controversial) means of control 
by the FAA to help ensure safety: Regulating average landing fuel levels and 
monitoring actual landing fuels to ensure that airlines are not routinely 
pushing too close to the edge in terms of safety. Another type of control 
parameter was also discussed in the context of cornerpost loadings when 
there is a reduction in capacity: 
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• “The FAA could make percentage calls. If Delta is 72% of the operation 
in Atlanta, if they would like to move ten flights from Macey to Rome 
over the next three hours. Delta could move seven and Valujet could 
move one flight, and so on. With this strategy, you would start to 
assigning slots to each of those cornerposts, with each airline having a 
percentages of those slots if they chose to take them." 

Potential concerns with this type of control parameter were also discussed, 
however, based on past experience with such a strategy: 

• "They've tried to fix loading and we really didn't like it too much. That 
was the fix loading program that we had for Atlanta. We had delays 
every day. It did not work because it wasn't managed well. They used 
it as a way to manage the capacity and it wasn't valid, it just didn't 
work. They would take our flights every day and delay them. Say we 
had a push of 60 airplanes coming into Atlanta. They'd delay twenty of 
them because of demand over the fix. They did that every day. In 
contrast to that, now we've got a scenario where we do some airborne 
holding. We encouraged everyone to use holding to a certain extent, 
because we want to have airplanes available when the capacity permits 
them to land." 

In short, the experience was that the estimates used by the ATM system to 
initiate ground delays were too conservative: 

• "If, instead of holding those twenty flights on the ground, we had 
launched all twenty, we would have actually had only five that would 
have had some airborne holding. Why should we delay twenty flights 
when in fact there would only be five of them late. We can't do 
anything with them if they are sitting on the ground in Raleigh or 
Greensboro or whatever. If we've got them up there holding and there 
is a slot available, if somebody else is late or whatever, then we keep 
capacity up. Maybe the ATC specialists suffer from a lack of real time 
information over there. If they had real time information and knew 
exactly when everybody was going to come over those fixes, maybe they 
could manage better." 

A suggestion to help deal with this conservatism and this lack of access to real 
time information was to make decision-making more collaborative: 

• “We could be involved in the planning with them and say: Hey, don't 
cut at this number, let's use this other number because we don't care if 
some of the flights have to hold. We'll handle that ourselves. How 
about if I come up there with an hour and a half of hold fuel and if you 
get me in, you get me in?'" 
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• “You've got some traffic manager who's looking at all the data he has 
available and he says: 'Delta, you're taking up 50% of our traffic for the 
next two hours and we predict there is going to be reduced capacity. 
You can either send all your planes as long as we agree ahead of time 
about what they're going to do if they can't land there, making sure 
there is a safe place for them to go.' That way, you have a choice, but 
in the worst case, you pay the penalty and can safely divert. But my 
advice, based on the information I've got, suggests you ought to cut 
back. Now it’s my choice." 

"They're saying that, if they're right as a traffic cop, when the planes 
start arriving. I'm not going to get 100% of mine in there. American's 
going to get their percentage in and I’m going to get my percentage in. 
As another example, they might come up and say: 'We recommend 
you delay Flight 345 for 2 hours and 40 minutes.' I could then say: 
'How about if I delay that one an hour and a half and stick another 
hour and a half on Flight 262 over here.' This way they're giving me 
options to work with." 

• "Separate the roles here. One is information: 'There is a potential 
problem here.' Let us judge whether we concur with that. The other 
is: 'Here's a recommendation.' Let me decide how I want to deal with 
it. They become an advisor, like some sort of counselor." 

3.5 Summary and Conclusions 

This knowledge acquisition session provided a rich set of data for identifying 
issues related to the design of the current and future ATM systems. The 
issues discussed included procedural changes as well as areas for technology 
development, and dealt with concerns over organizational behavior as well 
as individual performance. For the convenience of the reader, we 
summarize the issues here in the order in which they are discussed in the 
report, rather than attempting to prioritize them. 

3.5.1 Scenario Development 

It is clear from this knowledge acquisition session, as well as others we have 
conducted, that specific scenarios, properly used, help elicit very useful 
information from subject-matter experts. One of the challenges in 
developing future systems will be to idenfity all of the relevant scenarios and 
to ensure that the full range of relevant expertise is accessed. 
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3.5.2 Benefits Associated with the Implementation of the Expanded NRP 

The data presented indicate that, for a single carrier during a single month, 
the total estimated dollar savings from the NRP amounted to over $500,000. 
This fact alone, if substantiated by data from other airspace users, indicates the 
potential gains to be realized from providing carriers with greater flexibility 
(see below). 

3.5.3 Areas for Improvement 

Flexibility: The quotations presented earlier exemplify some of the constraints 
imposed on flights in the present system. While some may be the result of 
ingrained conservatism in the ATM system, some are clearly the result of 
mismatches between the present strategically-based system and the loosening 
of strategic constraints under the expanded NRP. 

What we are seeing with the expanded NRP is one of the first attempts to 
implement a hybrid system, in which management may be either by 
directive, by permission or by exception (see also report no. 5 in this volume). 
It is clear that, although this is viewed as a step in the right direction, users 
feel they need more flexibility, expecially with respect to timing, diversion 
options, speeds, and runway assignments and routings. Dispatchers 
recognized the problems ATC would have in granting greater flexibility, but 
they also point out the costs of operations under present constraints. 

Feedback: The issues of information management and information sharing 
have been pervasive in the data we have collected in support of these studies. 
This is not only a problem in ATM/ airline communication; it is as serious a 
problem within the airlines themselves, and within the ATM system. As 
authority begins to be diffused throughout the system, more information is 
required in more places, to be used by more people for decision-making. This 
is seen in many of the following sections of the report. 

Computer Support and Information Exchange: Better tools are needed if 
human operators in the system are to make better use of its resources. The 
examples presented above identify decision support tools that are needed to 
accomplish specific dispatching tasks, with a particular emphasis on the need 
to support information dissemination and cooperative problem-solving. 

Given the large amount of information presently resident in the system, and 
the limited capacity of human operators to deal with it at present, we believe 
that the area of information dissemination and representation is perhaps the 
most critical and potentially productive area for intensive exploration and 
development of new aiding technologies for a future ATM system. Such 
information exchange is critical to both individual and group problem- 
solving. 

Training: The observations from this group refer to the training and 
education of pilots, but this is suggestive of broader issues as well. It is clear, 
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for example, that the Air Traffic Management system has an incomplete 
understanding of the needs and priorities of air carriers. The comments in 
this session also suggest that some ATC facilities may also lack knowledge of 
how other facilities have coped more effectively with the similar problems. 
(See Results: Capacity Constraints; Organizational Problems). 

Other Capacity Constraints: The issue of extending the scope of flexibility to 
surface movements is one that may require different strategies as well as 
different technologies for its solution. 

Organizational Issues: It is regrettable, in some respects, that the original NRP, 
which required a good deal of discussion and interaction among all system 
participants, has given way to the expanded NRP in which these participants 
are expected simply to make decisions without such consultation and 
discussion. These data suggest that ways must be found to enhance and 
reward a more communicative, consultative, and therefore cooperative style 
of operations in the NAS. 

Dispatcher Workload Problems: The issue of simply transferring, rather than 
mitigating, operator workload is discussed under this heading. Care must be 
taken to alleviate workload under high-intensity conditions, not to transfer it 
from one set of system participants to another. One type of solution is for 
long-distance conflict prediction software tools, when they become available, 
to be made accessible to both ATM and AOCs. 

3.5.4 Regulation of Airline Performance in New ATM Initiatives 

The overarching issue of mediation among participants in a more flexible 
system must be approached by system designers. Given the competing 
objectives of users, does there need to be a neutral "referee"? 

There is no question that the ultimate locus of control and the authority to 
assure safe separation of aircraft in a future system will reside with ATM staff. 
Just as aircraft automation can foreclose or render less effective pilot 
authority, however, the rules, procedures and software for a more flexible 
ATM system, unless carefully designed, may foreclose or make less effective 
the authority of air traffic managers and controllers under some 
circumstances. This is a system integration issue that requires further 
research, but the dimensions of the issue are evident even in the research 
done to date. Cooperative decision-making was suggested as one way to 
reduce problems with real-time decision-making in this area; post-operations 
analyses of system performance was identified as a second, complementary 
approach. 

It is clear, however, that the functional requirements for a future system must 
include at least an outline of the policies and procedures under which the 
system will function, and that these functional requirements must be in place 
as a guide for the design of the equipment which will assist human operators 
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in the operation and management of the system. Though the philosophy of 
human- or user-centered automation has been accepted by at least some 
system proponents, such a general philosophy must be particularized in 
terms of the ATM system before the design of its architecture can be made 
final. 


3.6 Recommendations for Further Research 

Based on these results and our other research to date, we make the following 
recommendations for further work. 

• Expand research on the overall functional requirements for a future 
advanced ATM system embodying management by permission and 
management by exception, to serve as guides for the development of 
aiding technologies to be implemented in such a system. 

• Accelerate and expand research on information management for a future 
ATM system in which responsibilities and authority are more widely 
distributed among system participants. This research should include: 

- Information requirements under a management by permission 
paradigm; 

- Information requirements under a management by exception 
paradigm; 

- Methods and technologies to improve the sharing of information; 

- Means by which information assimilation can be enhanced; 

- Information representation technologies and methods suitable for: 

Airline Operations Centers; 

Pilots in flight; 

Traffic managers; 

ATC controllers operating under management by exception rules. 

• Search for ways to improve collaborative decision-making among system 
participants in addition to studying technologies that will more effectively 
share relevant information among those participants. 

• Continue and if possible expand research into ways of providing more 
flexibility for airline operations. 

• Explore the issues raised by the probable need for a neutral "referee" or 
arbitrator in a more distributed future ATM system, and examine 
proprietary and competitive issues embedded in information 
requirements, since these are the issues most likely to inhibit sharing of 
information in a more distributed system. 
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4.1 Introduction 

The goal of this project has been to provide NASA's Advanced Air Transportation 
Technologies program with input regarding a number of important human factors 
issues pertinent to the design of the future air transportation system. To collect 
relevant data, a scenario was designed to study critical features of a possible future 
system, and was used to provide the context for a conceptual or semantic-level 
evaluation by a group of practitioners representing different system perspectives. 
The results of this conceptual evaluation, which included two controllers, one 
dispatcher and one pilot, are presented below. 

4.2 Methods 

The scenario was first reviewed for accuracy and realism with three traffic managers 
from the airspace used in the scenario. It was then presented to the participants for a 
conceptual evaluation as an incident report, outlining a situation purported to have 
arisen in 1997 (see report no. 2, pp. 2-19-22 in this volume for the scenario and 
incident report). The participants were asked to review this incident report, and 
then to play the role of a review team evaluating the report. 

4.2.1 Scenario Characteristics 

This scenario is based on a problematic situation that already exists in Oakland 
Center as a result of responses to the expanded National Route Program (NRP). 
Specifically, in order to accommodate airline requests for more flexibility in selecting 
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routes during preflight planning, in Oakland Center airspace high altitude traffic is 
being allowed to criss-cross through arrival lanes: 

• Traffic Manager: "We re seeing a funnel effect. Where it used to be we 
would have two streams down to the Los Angeles basin, now everybody aims 
for Avenal. This works OK a lot of the time, except when things go wrong. 
When they go wrong, you suddenly have a whole herd of airplanes pointed 
at one point and a last minute change such as the need for an increase in the 
miles-in-trail or an airplane taking a wrong clearance, or any number of 
things, can cause a serious problem because you have a real concentration of 
airplanes. Suddenly you have to pull the plug to deal with it, whereas before 
at most you had a miles-in-trail situation, you had a bit more leeway. Even 
when it's workable, it puts a burden on the controller because it's not 
something they do every day. 

• "If you just take those aircraft crossing Coaldale at 39,000 feet, they’ve got to 
cross Modesto at 24 and you've got airplanes southbound at 29, 33 and 37, 
[and] northbound at 31, 35. It’s pretty much like a charge. It makes it real 
hard to thread that guy from 39 down to 24 and at the same time do all the 
things you have to be doing. If it was just one airplane to get through 
anybody could do it, but we're talking multiple airplanes, because it's the old 
push time and they're all coming at once. Twenty minutes later there may 
not be an airplane in the sector, but for those 20 minutes it gets wild and 
crazy. Not having them on the routes the way they used to be has caused a lot 
of heartburn for the controllers. They're having trouble getting them down." 

Thus, although Oakland Center is allowing flights on this user-preferred "economy 
route", it is problematic because it results in high altitude traffic flying through 
airport arrival lanes. 

This design of economy routes is not unique to Oakland Center. It has been a 
common response by a number of Centers to accommodate the desires of the 
airlines to fly more efficient routes. Furthermore, the problem of high altitude 
flights on such "economy routes" crossing through departure and arrival lanes is 
not an isolated occurrence. Other Centers are dealing with exactly the same 
problem. Some, like Oakland, are able to cope with the added complexity and thus 
allow such routes. Others, like Chicago, have found that approving such routes 
reduces departures by as much as 20%, and therefore are limiting such routes: 

• Traffic Manager: "For certain flights over the top of O'Hare, Chicago Center 
has always preferred that the traffic be routed over Badger in order to avoid 
having enroute traffic cross the departure lanes. One airline, however, 
prefers (and began filing) these flights over Iowa City-Waterloo under the 
expanded NRP. Such flights criss-crossed through the departure lanes, 
creating a 'very tricky, complex operation' for ATC. This raised an interesting 
question: Do you let 3 or 4 planes cross at the cost of slowing departures by 
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about 20% ? This tradeoff is particularly interesting given such flights were 
most often slowing departures from Chicago of flights by two other airlines." 

Thus, this scenario clearly represents an important general situation that must be 
considered in designing a future air traffic system which attempts to accommodate 
the desires of the airlines for more flexibility in selecting routes for their flights. 

This scenario presents a situation that already exists, and that can be expected to 
continue in any future Free Flight environment. The simple fact of the matter is 
that there are many locations where the most economical routes cross through 
airport departure and arrival lanes. Thus, NASA needs to ask: 

• What can be done to improve the ability of the system to deal with such 
situations, so that the airlines' desires can be safely accommodated more often? 
(New technologies? New procedures? Changes in sector designs? Changes in 
controller staffing models?) 

• What can be done to improve (pre-flight) information exchange so that the 
airlines know when a flight along an "economy route" is likely to be vectored off 
that route in order to avoid conflicts with arrivals or departures at an airport 
(since, given such information, the airline might choose an entirely different 
route to begin with)? 

This scenario also explores issues, beyond the existing situation, that have arisen as 
a result of efforts to give the airlines flexibility in pre-flight planning, however. To 
explore other issues associated with the design of a future Free Flight environment, 
we added another form of flexibility to the scenario: The ability for an individual 
flight to change its route while airborne, without having to seek permission from a 
controller. 

The net result is a scenario in which high-altitude Free Flight traffic (which is 
monitored but not controlled by ground-based controllers) is crossing through 
departure and arrival lanes with traffic that is under the control of ground-based 
controllers. Within this setting, we then introduced an incident: One of the Free 
Flight aircraft encounters turbulence and elects to change altitude. This produces a 
potential conflict with an arriving aircraft, which the involved flight crews and 
controller fail to resolve before minimum separation standards are violated. (The 
problem is resolved without a collision, however.) 

Thus, this scenario has a number of important characteristics: 

• At a strategic level, there is a potential goal conflict: The desire for efficient high 
altitude routes potentially conflicts with the desire for maintaining airport 
arrival and departure capacities; 
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• In trying to accommodate these two desires, a situation arises where there is a 
mixed locus of control for the traffic involved. Some of the traffic is under 
controller supervision, while other traffic is flying under Free Flight rules; 

• As a result of unexpected turbulence, one of the Free Flight aircraft makes an 
altitude change, resulting in a potential conflict; 

• Because this potential conflict arises in a sector with heavy traffic congestion, and 
because of the complexity of the situation with its crossing traffic and the mixed 
locus of control, the affected pilots and controller fail to detect and deal with the 
situation in a timely manner. 

4.2.2 Subjects 

Prior to the actual use of the scenario, three traffic managers from the affected 
airspace were asked to review the scenario. Then, for the conceptual walkthrough, 
two Center controllers, one airline dispatcher and an airline pilot served as subjects. 


4.2.3 Procedure 
Briefly, the subjects: 

• Were told that their role was that of a review board responsible for evaluating 
this incident and for making recommendations for future system enhancements 
(including the development of new technologies, changes in roles, 
responsibilities, procedures, etc.); 

• Reviewed the scenario prior to the day of the data collection session; 

• Met and worked through the scenario as a team, discussing relevant aspects of 
the incident as it unfolded, and identifying important issues that arose at 
different points in the scenario. Members of the research team probed for further 
details as the scenario walkthrough proceeded, to help ensure that the critical 
questions were addressed. These interactions were tape-recorded for later 
analysis. 

4.3 Results 

Based on the data provided by this conceptual evaluation, a set of recommendations 
was developed. This interpretation of the input provided by the participants in the 
study was then reviewed by those participants to ensure that it reflected their input 
accurately. Given the limited number of participants involved at this point, these 
recommendations should clearly be viewed as a basis for further discussion, rather 
than firm conclusions. As part of our discussion of each recommendation, we also 
make explicit its potential implications for future research. 
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4.3.1 Realism of the scenario 


The participants were very comfortable with the validity of the the scenario: 

• Controller: "Very realistic scenario you put together here." 

• Dispatcher: "From what I see in the airline, it's also very realistic. From what 
we see on our ASD screens, it's very real. I don't know if there's a whole lot 
more you could do to make it more realistic." 

4.3.2 Assumed Model of the Free Flight Environment 

Based on the discussion stimulated by this scenario, the participants made explicit a 
number of assumptions that they were making about a future Free Flight 
environment. These assumptions went beyond the conditions explicitly stated as 
part of the incident report: 

1. The traffic management organization responsible for strategic planning would 
identify which portions of the airspace were open for free filing of flight plans, and 
of that airspace, which portions were open for Free Flight while enroute. Those 
portions open for free filing but not for Free Flight while enroute would require 
flights to fly under the positive control of controllers while in that airspace; 

2. This information would be communicated to the AOCs so they could plan 
appropriately; 

3. As long as the airspace along a proposed route was open for free filing of flight 
plans, the AOC could simply file the desired route. If there were enroute Free Flight 
restrictions along all or part of the route, the AOC could still file its desired route, 
but the flight would have to operate under controller supervision on the restricted 
portions of the route; 

4. The flight crew would depart knowing which segments of a flight were open for 
Free Flight; 

5. Even for flight segments filed for Free Flight, the controller for that sector would 
have ultimate authority to ensure separation. When the flight entered that 
controller's sector, he would transfer that responsibility to the cockpit, with the 
concurrence of the pilot, or leave it with the pilot, if the controller and pilot felt that 
it was safe to do so. As part of that process, the controller would have to provide the 
cockpit with all of the information that was not available on cockpit displays but was 
necessary to ensure adequate situation awareness. That could include information 
about the intentions of other Free Flight aircraft and of other non-Free Flight 
aircraft, information about the weather, and information about possible 
contingencies or possible behaviors of other aircraft. (An alternative might be to 
have such transfer of responsibility occur at a Center level, so that fewer 
ATC/ aircraft interactions would have to occur); 
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6. While flying Free Flight, the pilot could make flight plan changes without 
permission from the controller. He would have access to a situation display and a 
conflict probe system to help evaluate the safety of a change under consideration. 
Because the conflict probe might not have access to all pertinent information, 
however, the pilot would take ultimate responsibility for making a change, and as 
part of that responsibility would have to make sure that he or she was aware of any 
information and contingencies that were outside the scope of the computer's 
capabilities. The pilot would also have to be able somehow to inform all other 
aircraft of his intended change; 

7. With computer assistance, traffic managers and controllers would monitor the 
overall situation in addition to controlling non-Free Flight traffic. If a situation was 
detected that required restricting Free Flight, placing flights in some area back under 
positive control, affected flight crews and AOCs would be informed as early as 
possible so that they could make appropriate adjustments. If instead a simple flight 
amendment was required for an individual flight, the controller would inform the 
crew. If appropriate, and if his/her workload permitted, the controller might give 
the crew several options to select from. If time or controller workload required 
acting without discussion, the controller would so inform the crew. Following the 
requested amendment, the flight would be allowed to continue in Free Flight if the 
situation allowed it; 

8. If conditions allowed, a flight could potentially continue in Free Flight as far as 
the outer marker (or even gate to gate). 

Explicit identification of these assumptions is important, as there are obviously 
alternative definitions of a future Free Flight environment, and the assumptions 
made influenced the participants' evaluation of the incident report. These 
particular assumptions reflect the views of the participants at the time of the 
conceptual walkthrough, and do not necessarily match the details of the RTCA 
report on Free Flight (RTCA, 1995). 

Recommendation 1. Experience with the expanded NRP has made it clear 
that an important scenario that must be dealt with in a Free Flight 
environment is the crossing of arrival and departure lanes by high-altitude 
traffic. The quotes from traffic managers presented earlier make it clear that, 
under current conditions where individual flights are under controller 
supervision, this is a "very tricky, complex operation." This complexity 
would potentially increase under Free Flight if the high altitude aircraft were 
flying under Free Flight rules while some or all of the departing and arriving 
aircraft were under controller supervision. 

As the questions below indicate, considerable study is needed to determine whether 
Free Flight can be accommodated under such conditions and, if so, what needs to be 
done to accommodate it. 
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Research Questions: 


What procedures should be followed in such scenarios to ensure safe, efficient traffic 
management and control? What does it take to make the filing of such routes 
acceptable? 

What new technologies or other changes (such as the creation of new sector 
boundaries, changes in controller staffing of sectors, etc.) could make such routes 
less of a problem? 

Can enroute Free Flight be allowed in such sectors, or should such flights always be 
under positive control by controllers? 

Recommendation 2. The situation probed in this critical scenario was not 
highlighted by the simulations that have been run to evaluate the impact of 
Free Flight on air traffic patterns, suggesting that improvements are needed 
in the design of such simulations. 

Research Questions: 

How should the existing simulation systems be enhanced? 

Should empirical data be collected to evaluate the predictions of these simulations? 

Recommendation 3. On any given day, routes or segments of routes will 
arise that cannot accommodate a particular flight at all, or that cannot 
accommodate that flight under enroute Free Flight rules because of weather, 
traffic congestion, airport restrictions, etc. Such routes need to be identified 
ahead of time if possible, and need to be communicated to AOCs so that they 
can consider the restrictions during their pre-flight planning. In essence, in a 
Free Flight environment, AOCs need traffic and ATC forecasts just as they 
need weather forecasts. In addition, a neutral referee (the traffic management 
system) needs the authority to deny a request for a particular route, or to deny 
flight under enroute Free Flight rules along that route (or some segment of 
the route). Such restrictions would be based on considerations of safety and 
the impact on overall system capacity: 

• Controller: 'Traffic management would determine what routes would be 
inappropriate for Free Flight based on predicted weather and traffic, and 
would program the computer. The dispatcher would send in the flight plan 
two hours ahead of time and the computer would analyze it. Then the 
dispatcher would get an acknowledgment that that flight can't go today Free 
Flight. Then he could do better flight planning on it. The pilots would know 
before they leave that they're not flying Free Flight." 

• Controller: "You’ve got 140 major city pairs, and those are going to be your 
major players. So it wouldn't be hard." 
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Research Questions 


What tools or procedures would reduce the number of situations where such 
restrictions would be necessary? 

Can tools be developed to help identify such routes or route segments? (This 
includes communication tools to improve input from regional traffic management 
centers as well as tools that automatically look at collected data.) 

Can tools be developed to help disseminate such restrictions to AOCs so that they 
can plan more efficiently and effectively? 

If some segments of a flight are under Free Flight rules while others are not, how 
will transitions be handled once a flight is enroute? 

Recommendation 4. The air traffic control system has to be designed to 
handle situations where, during the course of a flight, enroute Free Flight 
may have to be rescinded for some segment because of weather, traffic, airport 
restrictions, etc.: 

• Controller: "There's going to be instances and times when Free Flight is 
going to have to be terminated, and weather is going to be the key time that 
Free Flight is going to have to be terminated for a given area, for a given 
time." 

• Controller: "If we have a large number of aircraft involved, that falls back to 
the controller and they have to have the final authority. You may have the 
cockpit say: 'Well, I want to do my own separation on this conflict.' You 
have to be able to say no because there are too many involved." 

Research Questions: 

What procedures should be defined to handle such transitions? 

• Controller: 'There are situations where you could say: Do you want to do 
this or do you want to do that, like we do today. I've got traffic here. Do you 
want to descend? Do you want to turn? What do you want to do? Do you 
want to slow down a little bit?’ And we'll give them multiple choices, time 
permitting. Now, when we re real busy, it’s: 'No. You do it.' We have to 
build something similar into any type of flight because there is the big 
picture." 

• Controller: "One of the things that’s hard for me ... is at what point does Free 
Flight stop and air traffic control take over? If I'm separating one aircraft 
from another, do I have to take both these guys off of Free Flight? Because I 
can't very well give this guy an instruction based on what I hope this other 
guy's going to do. And add a third or a fourth or a fifth aircraft into the 
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situation, now do I have to take six people off Free Flight? How do I take 
them off Free Flight? How are these things communicated? At what point 
do I put them back? ... So that everybody's singing on the same page. ... Every 
time there's been a separation loss, it always seems to be based on some 
miscommunication somewhere. I think you're doing something when 
actually I was the one who was supposed to be." 

• Controller: "This is a real good situation because you have one airplane that 
could easily affect 3 airplanes in a very tight space and yet these 3 airplanes are 
possibly flying along minding their own business, they're fine. ... To solve it, I 
may have to step on the toes of 6 or 7 airplanes and make sure I know exactly 
what their intent is before I can solve this situation. Today I could solve that 
with one transmission. Now it might require six transmissions before I could 
even begin to solve it, because there's no sense in me laying out clearances if 
all these other guys are going to start cranking and banking without telling 
me, which is the same thing as doing it and then telling me." 

How will sufficient controller staffing be assured to handle such transitions from 
Free Flight to controlled flight? 

What situation displays and decision support tools need to be given to controllers to 
assist them in detecting such situations and making the transitions? 

What technologies are required to reduce the frequency of occurrence of the need to 
rescind Free Flight? 

If such a segment can be identified well prior to the flight reaching that point, how 
can this information be disseminated to the AOC and/or the flight deck so that the 
operator can revise his plans if desired? 

Are the points where this is going to be necessary going to occur with a frequency 
and at locations such that enroute Free Flight is not economical? 

• Pilot: 'This is the rub of the whole idea. ... If you restrict it where you start 
getting into the approach phase, from the outer points on in, and you are 
going into procedural separation there, you've basically lost most of the utility 
of Free Flight. ... What they [the airlines] want, they want random access all 
the way to the numbers, or let's say to the outer marker." 

• Controller: "We d like to see more airborne resolution. There's a lot of 
scenarios where it could be done easily ." 

Recommendation 5. Controllers need to play a dual role, as information 
providers and as controllers. Situations will arise where the controller sees 
some change that may desirable (but not necessary) for an aircraft under Free 
Flight, and will simply communicate this suggestion to the cockpit without 
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rescinding Free Flight. The crew can then choose to act or not act on this 
suggestion in consultation with their dispatcher (thus allowing them to make 
a decision based on business concerns). Situations will also arise, however, 
where the controller notes a necessary change. In such situations, the 
controller could choose to simple issue an instruction such as: "Maintain 

altitude and turn right 5 degrees to maintain separation from Flight 470, then 
resume Free Flight." 

• Controller: If an aircraft is in a Free Flight mode and you have to issue an 

instruction to them, I don't consider that taking them into a structured 
system. I'm just resolving a conflict. ... Once the conflict is resolved, they're 
still in their Free Flight mode and they just continue on." 

Research Questions: 

How should such instructions be handled procedurally in order to make sure the 
flight crew knows when a controller is giving a command vs. a suggestion? 

• Controller: "There's times when the pilot and controller do not have time to 
battle back and forth as to what's the best plan." 

• Controller: "The time frame that that all takes place in, the time that the 
conflict resolution software generates a resolution, that's given to the 
controller, he digests it, and then it's sent to the crew and they digest it and 
decide: 'Do I act on it or not?' Things are moving very quickly." 

• Controller: "Absolutely. And at closure rates at high altitude, you don't have 
the time span for that flight crew to second guess what the controller's doing 
because they don't have the big picture for the entire sector." 

What technologies can assist with the detection of situations that require some 
prompt action? What should the role of such technology be (providing advice to 
the controller vs. issuing a command directly to the flight)? 

• Pilot: "In the South Pacific, what they're finding is, ATC doesn't want to 
monitor all of the airplanes. ... All they want to do is they want to monitor by 
exception, which means they want to find out if something isn't going right." 

• Controller: "It seems like it's a little late to do something by then. It all 
depends on how far apart these airplanes are. If they're in close proximity, 
the guy goes 300 feet, too late. By the time I get the alert, separation is already 
gone." 

• Pilot: "This is different because we're talking the oceanic environment." 
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• Controller: "I can see that argument from the oceanic controller's 

perspective, because typically they have, you know, one stream's going west, 
one stream's going east, and I just have to worry about these two. They don't 
have flights going from every compass point to every compass point." 

What technologies can assist with the resolution of situations that require some 
prompt action? What should the role of such technology be? 

• Controller: "The conflict resolution software is only going to offer or propose 
a solution to the controller. The controller may or may not elect to do what 
that recommends." 

• Pilot: "The computer can't take into account all of the variables that are going 
to be out there, for example weather." 

• Controller: "Or non-participating aircraft." 

If the controller plays a passive role most of the time in the detection and resolution 
of problems, will he or she be able to anticipate and deal with the exceptional 
situations that the computer cannot cope with? 

• Dispatcher: "And yet human factors come back into play once you get beyond 
a certain point, because, if you're a system manager, you're not actively 
participating as much as you were before. The only time that you're actively 
participating are those high stress situations where there is an alert, people 
are operating at reduced separation standards because there are more 
airplanes in the sky, the stress level goes through the roof." 

• Controller: "And proficiency comes into play. ... You're only going to be 
jumping in ... on an as needed basis.” 

How big a picture should the flight crew be given? What technologies are necessary 
to provide this picture? How will the differences in the data and perspectives 
available to flight crews and controllers be dealt with? 

• Dispatcher: 'The scope of the situation display in the cockpit will be a given 
area that they will be able to see. You guys [the controllers] will have the 
much larger picture as to what's going on, so I think they may think, well, the 
whole world is revolving around me and just 2 or 3 other planes around 
them, and they don't realize the conflicts with the much wider, broader area." 

Recommendation 6. In order to assure that enroute Free Flight can be safely 
be supported with acceptably small separation distances, intent information 
must be available on all involved aircraft for all of the individuals with 
authority to change the course of an aircraft (controllers and flight crews on 
aircraft flying under Free Flight rules): 
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• Controller: "For any kind of ground-based conflict resolution to be anywhere 
near efficient, it must have intent. Or airborne resolution." 

• Controller: "There's corridors in the Northeast and things like that where, 
without intent known in a Free Flight environment, it'll never become a 
reality because of the volume and the density of the traffic." 

Referring to the loss of separation that occurred in this scenario, the participants had 
a number of comments: 

• Controller. The overload was caused by the fact that he was surprised. 
Something happened that he wasn't planning on. An airplane's moving on 
its own without telling me about it. That starts the whole workload ball 
building up. What was a very manageable situation all of a sudden now gets 
out of hand." 

• Controller: "Today if this happens. I've got a surprise, I can handle it because 
I know what everybody else is doing. They're doing what they 're supposed to 
be doing. But now there's a whole lot of question marks after all these call 
signs. In fact, that s how I would probably identify the guys who are in Free 
Flight. I'd have the computer put a question mark after his call sign because 
I'm not positive what he's going to be doing." 

Minimally, this seems to imply that: 

1. For any given sector, the involved controllers and flight crews need to know 

about the planned routes for those aircraft using the FMS to fly along filed flight 
plans; ° 

2. If a flight changes its flight plan, and the crew enters this change in route on the 
FMS, then that change needs to be transmitted to all of the relevant controllers and 
flight crews; 

3. If a flight changes its route, but the crew elects to "hand fly" the airplane, their 
intentions must be verbally transmitted to all relevant controllers and flight crews; 

4. If such intent information cannot be specified and communicated adequately, 
then the flight will have to revert to controller supervision: 

• Controller: "You'd have to have the termination of Free Flight any time that 
you don't have proper [knowledge of) intent." 

Recommendation 7. When a flight crew flying under enroute Free Flight 
wants to make a change in its flight plan (other than an emergency 
deviation), some agent with full awareness of the situation (including 
weather, the intentions of all aircraft, the actual behaviors of all aircraft, likely 
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changes in the intentions of all aircraft, and available contingencies) needs to 
evaluate the proposed change to make sure it maintains desired separation 
levels. If there are weather disturbances, intentions, likely behaviors, or 
contingencies that cannot be encoded in a form the computer can handle, 
then that agent must be a person. 

Research Questions: 

What information can actually be incorporated in a computer system that is meant 
to provide a conflict probe? 

Should a flight under enroute Free Flight have to communicate with other Free 
Flight aircraft in the area before initiating a change? 

Because of the potential brittleness of computer systems, and because of the need for 
the people involved to maintain situation awareness, should some person always 
be required to give final approval (with computer systems designed as support tools 
for that person)? Initially, one of the controllers seemed to feel that the controller 
could be left out of the loop when a flight was flying under Free Flight rules, with 
the flight crew and a computer-based conflict-probe system taking responsibility for 
separation unless the conflict probe detected a problem and alerted the controller: 

• Controller: "You've got the midwest of the country and all that, the high 
altitudes under the Free Flight environment. The controller workload would 
be considerably gone, eliminated, if he had a ground-based conflict probe. 
You wouldn't have to constantly scan the scope trying to pick out conflicts 
because it's already being done [by the computer]." 

Further discussion seemed to rule out this point of view, however, because of the 
likely limitations of the technology: 

• Controller: [In response to the question: "Are you comfortable with the idea 
that the computer would automatically pass through an OK, or do you need a 
person to approve it?"] "No. The biggest problem I have with that, especially 
with Salt Lake Center, is weather. The computer doesn't know weather ... 
The computer doesn't know wind shifts. There's so many times that our 
conflict alert gets fooled, and it's based on the last heading and speed, and 
somebody's going through a windshear. I may have sat at that sector all day 
long and watched these guys, you know, headings change dramatically when 
they hit this windshear. The computer, at least I don't know of any way of 
telling that computer where the windshear is, how it's been moving all day 
long, and to let it make those adjustments for me in its conflict probe. At 
least in the airspace I work, we get these dramatic jetstreams coming down 
there. You'll have a 40 degree heading change there sometimes. 
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“So some of those things, I just don't see the computer being able to predict or 
really help me with. You have huge thunderstorms, and every airplane in 
the sky is diving for a hole. I don't know how we communicate that to the 
computer, and how it's going to help me do the conflict prediction through 
this hole. ... So if we're taking the same amount of airplanes on a normal 
good weather day, we're going to have twice as many airplanes in a sector 
now, we're going to have half as many people, fine. Now, on a bad weather 
day, where I've lost the aid of this wonderful computer tool, and we're back to 
more of the old type of communication, with deviations, with all the things 
going on, you're going to be right back where you are today, except that you've 
got half the people out there to handle it, with twice as many airplanes. 
That's an exponential number of delays you're talking about." 

When should this person be a controller and when should it be the pilot? 

• Controller: "The concept is that the aircraft would have onboard ... some sort 
of aircraft situation awareness around it, that you would communicate to the 
aircraft what your intention is to resolve the conflict, and then just pretty 
much, just turn control back to the cockpit again, saying: 'This is the traffic. 
Do you have it on your situation awareness? Once you're clear of it, resume.' 
So the intent would be there for the crew too, for the cockpit, in case there 
should be communication failure or something like that. Or, we have 
discussed, that the cockpit at times, given certain situations, and the intent is 
well known, that they would provide their own separation. ... As long as both 
parties agree and they accept the responsibility, then they do it by whatever 
means." 

• Controller. There s so many times I've got one aircraft that's overtaking 
another and I want to say: 'Offset a couple miles and go around him or 
descend 300 feet and pass him.' I'll tell him the intent is to stay level. And 
then I'll broadcast to the other aircraft: 'He's going to come by you and all 
that.' Then, that takes my complete concentration away from those aircraft so 
that I can work on more. ... This is one way of taking some of my workload 
and shifting it to the cockpit." 

• Controller: "You can take a lot of workload away from the controller by 
shifting it to the cockpit. These are things that they need. They need the 
airborne conflict probe, they need to know the intent, and when you shift the 
responsibility, there has to be a clear understanding of the shift." 

When responsibility is handed off from a controller to the flight crew, what must 
the controller communicate to the crew to assure adequate situation awareness 
(weather information, the intentions of all other aircraft, the actual behaviors of all 
other aircraft, possible changes in the intentions of all aircraft, contingencies to 
consider, etc.), and how will this be communicated (verbal communications 
between controller and flight crew vs. computer displays of intent, weather, etc.)? 
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4.4 Summary 

Since the recommendations generated from the data of this conceptual evaluation 
are based on a small number of subjects, they should clearly be viewed as hypotheses 
rather than firm conclusions. They do serve, however, to raise numerous 
important questions that must be addressed in designing a future system that 
incorporates some of the goals embodied in the Free Flight concept. 

Some of these questions deal with the roles and responsibilities of flight crews, 
controllers, traffic managers and dispatchers. Some are concerned with the 
definition of procedures. Others deal with issues of workload, training and the 
maintenance of skills. Still others deal with communication. 

One question that must be dealt with is a clear definition of the information 
necessary to ensure situation awareness and to enable informed decisions to be 
made when a flight plan is to be amended. This investigation suggests that such 
information includes: 

• The intentions of aircraft participating in Free Flight; 

• The intentions of aircraft not participating in Free Flight; 

• The weather; 

• Possible unplanned events, including deviations of aircraft from their intentions 
(due to weather, for example); 

• The availability of reasonable contingencies to deal with unplanned events. 

Finally, almost all of these issues have implications for the roles and designs of 
support technologies. Such technologies include: 

• Tools to support cooperative work involving traffic managers, controllers, flight 
crews and AOCs; 

• Communication links (air-to-ground, air-to air and ground-to-ground); 

• Conflict detection and resolution software; 

• Cockpit and ground-based situation displays (for flight crews, controllers, traffic 
managers and AOCs); 

• Tools for strategic and tactical planning (for AOCs, traffic managers, flight crews 
and controllers). 
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5.1 Introduction and overview 
5.1.1 A future ATM system managed by exception 

Fundamental changes are thought necessary to respond to increasing demands for 
capacity and throughput in the American National airspace. Proposals for dealing 
with the capacity and efficiency challenges to the air traffic management system 
usually include two aspects. One is more freedom for airspace users, and the other 
is more automation of traffic surveillance and conflict detection. The important 
residual task that will be left to human controllers is one of supervision, that is, 
overseeing system activity and managing exceptions (RTCA, 1996, RMB, 1996). The 
concept is that in exceptional circumstances, i.e., cases where the system cannot cope 
by using its own inherent resources, a controller will have to sort out the situation. 

The desire to move from active control to less active supervision of system activity 
is by no means new, in many fields of activity. Similar shifts have already been 
noted on aircraft flight decks and also in many industrial applications. Problems 
with supervisory control tasks in such domains (most notably the "out of the loop" 
problem) are well-documented. The suggestion that an air traffic controller should 
become a "manager of exceptions", however, appears not to have been advanced 
thus far. References to management by exception can be found in supervisory 
control studies, but searches for it reveal that these discussions are not deep and 
leave the concept underspecified. 

It is important to examine closely what management by exception is, especially in 
terms of its implications for the cognitive work that a controller will have to do (in 


5-1 



collaboration with other system participants). What will the controller be looking 
for (supervising, monitoring)? When and how will he intervene? What qualifies 
as an exception? Answers to these questions are not just academic. T v ey will have 
a direct bearing on how necessary rules and procedures for a more flexible future 
ATM environment, and on what kinds of interfaces are needed to ensure that 
controllers, as well as pilots, dispatchers and other system participants get the right 
information at the right time. 

5.1.2 Overview of this chapter 

The studies discussed in this chapter were intended to provide some initial answers 
to the kinds of questions laid out above. They were an attempt to reveal the kind of 
work that controllers, pilots and dispatchers must engage in to run a future air 
traffic system safely and efficiently on a "management by exception" basis. These 
studies were aimed specifically at identifying areas where there is early evidence of 
potential human performance problems as a result of certain design decisions. 

Participants in the studies were controllers, pilots, dispatchers and traffic managers 
in today's air traffic environment. These expert practitioners were briefed on the 
rules and particulars of an envisioned air traffic management world and were 
subsequently confronted with concrete problems as they may occur in the future. 
The practitioners' differing perspectives on the problems and the environment 
generated discussion and revealed where problems may emerge with workload, 
information availability, communication, coordination and decision making. 

Participants were exposed to future problem situations in a widely agreed upon 
vision of the future air traffic environment described by RTCA (1995) and called 
"free flight". Some practitioners actually entertained more extreme interpretations 
of what the future world will be like. The findings of these studies cover the 
envisioned world proposed by RTCA (1995), but the requirements that can be 
generated from this research may be considered in relation to other versions of the 
envisioned environment as well. 

It appears that in management by exception a controller does not respond to 
anomalies per se, but needs to anticipate problems in how other agents (pilots, 
operators) are dealing with process anomalies. This requires him to make complex 
trade-off judgements that involve questions of how many aircraft to restrict in their 
flexibility, how much to restrict them, and when to intervene relative to the 
continuous emergence of evidence about impending problems. These trade-offs 
must be made under the time pressure of a potentially escalating situation, and 
within constraints that stem from considerations for safety, throughput, efficiency, 
economic interests of airlines, and empirical factors such as controller workload. 

A characteristic of more flexible air traffic worlds appears to be a wider distribution 
of information, knowledge and decision-making authority among system 
participants. This feature, which also emerges from other studies reported in this 
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volume, points to a burden on developers to incorporate robust means of 
communication, and to be sensitive to the fact that information sharing is subject to 
attentional and workload constraints during periods of high system activity. 

5.2 Management by exception 

Although management by exception seems an intuitive concept that could be used 
to guide future system designs, there is neither a generally accepted definition of 
management by exception nor much specification of what it actually could be. The 
concept of management by exception was born out of the supervisory control 
paradigm in the mid- to late seventies (Sheridan, 1976). This paradigm, in which a 
manager supervises subordinate agents (mostly computers and other machines) in 
their execution of domain tasks, gave rise to the question what the relationship 
between a supervisor and subordinates could or should be. 

With increasingly capable subordinate agents, one possibility for this relationship 
became based on the principle of exception. Wiener (1988, p. 456) explains this 
principle by stating that "as long as things are going well or according to plan, leave 
the managers alone. Don't clutter their world with reports, warnings, and messages 
of normal conditions. 'Exceptions' are pre-defined and lower level managers flag 
exceptions, which are routed to the manager". When exceptions are found, several 
things can happen (Sheridan, 1992). First, the subordinate could "allow the 
[manager] a restricted time to veto before automatic execution" of some resolution, 
or the subordinate "executes automatically and then informs the manager" (p. 358). 

Many questions arise from these definitions. Who notices the exception, for 
example, and if it is the manager who notices, what is he in fact looking for? Does 
he monitor for actual process conditions, or does he merely observe his 
subordinates and judge how well they are dealing with the process? Is he waiting 
for specific occurrences before he intervenes, or is the recognition of what is an 
exception a more abstract judgement? And when intervention is deemed necessary, 
does the manager take full control, or are there ways in which he and subordinates 
can redistribute and share authority over the process? 

These questions represent gaps in our current understanding of management by 
exception, and they form the motivation for the studies reported here. These 
studies have investigated the complexity that lies behind managing a future air 
traffic management system by exception; they have attempted to reveal some of the 
cognitive demands that are imposed on human managers who must anticipate 
problems in how other agents (human or machine) are handling a safety-critical 
process. 
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5.3 Method of investigation 

5.3.1 Investigating cognition in an envisioned world 

As noted in relation to other studies discussed in this report, and particularly in 
report no. 2 in this volume, management by exception in air traffic control does not 
yet exist. Investigating cognition in such an envisioned world is therefore a 
methodological challenge. There are no prototypes or system mock-ups, and no 
practitioners who work in the future world. Still, it is a tantalizing and potentially 
fruitful prospect to reveal some of the cognitive post-conditions of technological 
and procedural changes before large pools of resources are committed to particular 
designs. What are ways to detect new opportunities for error or other human 
performance problems in an envisioned environment? 

The biggest problem inhibiting the investigation of a future world is its 
underspecification. Many details of the envisioned environment will not have 
been worked out yet or made concrete through system design. Furthermore, every 
participant or stakeholder is likely to have a different interpretation of what the 
future will look like and how the system will work. In order to begin the 
investigation of a future world, some kind of consensus must be found. In the case 
of air traffic control, the interpretation of RTCA (1995) represents the broadest 
agreement yet on what free flight will be. Many different constituencies (air traffic 
control, airlines, pilots, manufacturers, NASA, Navy, Air Force) participated in this 
initial definition of a future air traffic environment in the U.S. 

5.3.2 Future incidents 

The proposed rules, roles and technologies that together make up RTCA's version 
of the future world were confronted by hard constraints and problems that occur in 
the airspace environment, irrespective of which air traffic control technologies or 
rules are applied (e.g., weather problems or mechanical failures in aircraft). This 
marriage between future designs and timeless problems produced "future incident 
scenarios" that were put before expert practitioners (air traffic controllers, pilots, 
dispatchers and air traffic movements coordinators). 

In order to cope with the underspecification of the future world, it was critical to 
simultaneously anchor different expert practitioners in the details of coordination, 
communication, decision making and knowledge exchange necessary to handle the 
incidents successfully (Smith et al., 1996). This encounter of multiple practitioner 
perspectives with concrete future problems exposed disjunctions in how the various 
groups (pilots, controllers) interpreted the problem. These disjoints were places 
where, for instance, practitioners' goals conflicted, or where information thought to 
be readily at hand was actually unavailable. 

Rather than providing yet another potentially underspecified demonstration of how 
the future world might function, these incidents, and the disjoints in perspectives 


5-4 



they revealed, produced data about where a future architecture might be vulnerable 
or how it may break down. Thus, the incidents invited practitioners to think 
critically about the cognitive work and tools required for effective problem solving 
in the envisioned world. 

In the studies reported here, participating practitioners were presented with future 
problem scenarios by way of a "cognitive walkthrough". Practitioners were first 
prepared for their future roles and rules by briefings and specially prepared 
handbook excerpts (see report no. 2 and Dekker, 1996). Then they were provided 
with the initial conditions of some situation, as represented on a "game board" -- a 
rendition of a radar screen on which participants could annotate (and leave a trace 
of) their suggestions for solutions. Thereafter, participants were left on their own, 
caught up in the evolving incident. The area in which the future incidents took 
place was a segment of airspace in the U.S. (see p. 2-15), modified to accommodate 
new free flight rules, that contained many interesting characteristics usable in the 
creation of incidents (thunderstorms, clear air turbulence, tunneling flows of traffic 
into a few major airports, crossing traffic, etc.). The discussions were recorded on 
videotape and transcribed later. 

5.4 Findings of the studies 
5.4.1 Different participants: different goals 

In a more flexible air traffic environment pilots may be able to pursue their 
company goals better than they can today (RTCA, 1995). These company goals can 
include timely arrivals, fuel savings, customer satisfaction, etc. Controllers, on the 
other hand, will continue to be concerned with overall system goals such as safety, 
efficiency and throughput, and adherence to regulations. Although the pursuit of 
these diverse goals may be efficient from one perspective, it can be problematic from 
another. For example, going for a different altitude because of more favorable winds 
is productive from a local company perspective. From the controller's perspective, 
however, this may jeopardize his system goal of safety if many aircraft will be doing 
the same thing. This is the basis for management by exception in free flight: 
controller and pilots have different goals and different perspectives on the problem 
or process (see also Guerlain & Smith, 1995). 

Rather than handling process anomalies directly, the controller's focus is on 
responding to problems in how pilots are handling process anomalies. For example, 
a line of thunderstorms was presented as a system anomaly in one of the scenarios 
in this study. It turned out that the controller becomes involved not in reaction to 
this anomaly, but only when his system goals are jeopardized by the way in which 
other agents (pilots) are dealing with the anomaly. For instance, airplanes may start 
tunneling for a hole in the line of thunderstorms, which may produce problems for 
separation and safety. This also indicates that problems (possible separation 
conflicts, in this example) in how pilots are handling process anomalies must often 
be anticipated rather than awaited. Management by exception, then, is concerned 
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with handling problems in how other agents are dealing with anomalies in the 
process. Note that this means that a process anomaly does not necessarily constitute 
an exception that requires management intervention. 

5.4.2 Multiple trade-off judgements 

Anticipating problems in how pilots are handling process anomalies can be 
demanding. It may be difficult for a controller to gather evidence on precisely how, 
and how effectively, pilots are handling the anomaly. The demands produced by 
this uncertainty were demonstrated in a scenario that involved an aircraft with 
malfunctioning communications and collision avoidance equipment 1 . (Failed 
communications equipment is commonly referred to as "nordo", for "no radio"). In 
this future incident scenario, a nordo aircraft was approaching a stream of traffic 
inbound for a major airport (as schematically represented in figure 5-1). The nordo 
aircraft itself was originally headed for its homebase, but after the failure its 
intentions became uncertain. 



Figure 5-1: Schematic representation of the problem in one scenario 


1 The aircraft in this future incident scenario was transmitting code 7600 on Mode A of its 
transponder, indicating that it had suffered a communications failure. Transponding on Mode 
A indicates that Mode C and/or Mode S (crucial for today's on-board collision avoidance 
technology) may also be inoperative. This means that other aircraft interrogating this aircraft's 
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The ambiguity in the possible intentions of the nordo aircraft (is it going on to 
homebase for repairs, or is it going to land at the nearest suitable airport?) makes 
predicting how it will affect the stream of incoming traffic difficult. The controller 
does not know how pilots will deal with this anomaly in their process. Given this 
uncertainty, it turns out that in the controller faces three judgements in his decision 
to intervene: (1) the controller must decide when to intervene, (2) determine how 
many aircraft should be restricted in their flexibility, and (3) how much authority 
should be taken away from these aircraft. 

In trying to deal with the problem of a nordo aircraft, air traffic controllers 
negotiated a number of paths through these three trade-offs. In figure 5-2 these 
solution traces are marked at their starting points by the numbers 1 through 3. 
Remarkably, controllers did not reach consensus on any of the paths. Rather, they 
discovered a series of dilemmas (see the boxes in figure 5-2) and finally arrived at 
the third option, where they actually left themselves no room for their higher-level 
system view on this problem. There, the solution trace literally strays off the chart. 
The three traces are discussed in detail below. 



Figure 2: The three trade-offs faced by a controller: when to intervene; with 
how many airplanes, and how deeply. Traces 1-3 represent possible 
solutions (and outcome problems) that were explored by controllers. 


transponder may see it on their collision avoidance display, but they will not know its altitude. 
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Solutipn Trace L One controller proposes to deal with the nordo problem by asking 
all incoming aircraft to state their intentions before doing anything. Thus he can 
anticipate where problems are going to arise early on: 

• Controller 1: "I want everybody (referring to traffic east of OAL) to tell me 
before they do something." 

But according to another controller, such an early intervention means talking to too 
many aircraft - which imposes unnecessary attentional demands on a controller: 

• Controller 2: "But when I'm busy and I've got everybody and their brother 
either downlinking or yelling T'm climbing. I'm descending, I'm turning. I'm 
doing this, I'm doing that' - 1 could care less! Mind yourself, I'm going to take 
care of the imminent situation." 

Solution Trace 2. The alternative is to take control only over the airplanes that are 
closest to a collision threat, what controller 2 calls the "imminent situation". 
Taking full control represents a deeper intervention: 

• Controller 2: "The first two that I need to work on here are these two here. So 
I'm going to say, 'OK, sir. I'm going to ask you to set this puppy on its wing 
and turn in a second'." 

This turns out to be problematic. Since no other aircraft is asked to do or say 
anything, too few aircraft are involved in this intervention to assure that it is going 
to work: 

• Controller 3: "The missing thing here is that they [the other aircraft| don't 
need to fly a filed altitude, they can leave that altitude. I wouldn't turn 
anybody here; I think that would be a mistake." 

• Controller 4: "Yes, by taking positive control you can make it a lot worse." 

This seems to put controllers in a double bind. Intervening in the flight paths of 
only a few aircraft is deemed ineffective because it is not known (or controlled) what 
other aircraft in the vicinity will do. The alternative is to be informed about the 
flight paths of every aircraft in the area (as suggested in Trace 1) but this, let alone 
taking control over everyone, is judged to lead to workload problems. 

Solution Trace 3. The third trace represents some kind of resolution to the double 
bind. It essentially marginalizes input from a controller in this case. Given the 
uncertainty about the nordo aircraft's intentions (and those of the surrounding 


and their collision avoidance systems will be unable to issue them advisories for the resolution 
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traffic), holding off on an intervention may be the only way to see more evidence 
emerge on how the anomaly is developing. But by then it seems that nothing is left 
that a controller can usefully add to the situation from his broader systems 
perspective — in fact: 

• Controller 1: "They [the other traffic] would have a better view of the nordo 
aircraft with their 40 mile range TCAS than we have." 

• Controller 3: "And the nordo aircraft's fishfinder could still be picking up 
these guys here" (pointing to the other traffic). 

The suggestion to leave the airplanes to their own devices is directly related to 
uncertainty and a lack of knowledge about how traffic is going to behave: 

• Controller 4: "If you don't know what [the nordo aircraft] is going to do, what 
can you do as a controller? 

• Controller 1: "Since we don't have all the parameters, do we have to do 
anything?" 

This last remark is left as question rather than as a resolution. The dilemma of how 
(and whether) to deal with the problem of a nordo aircraft reveals some of the 
complexity of management by exception. Cognitive demands arise as a product of 
having to make multiple trade-offs in a time-pressured and potentially deteriorating 
situation. How many aircraft must a controller restrict? How far must (s)he restrict 
them? When does (s)he ultimately take over control? The solution traces show 
that these trade-offs are not independent, but that they interact in ways that can put 
controllers in double binds. For instance, early intervention must involve many 
aircraft, because evidence about exactly which airplanes are going to be a problem 
has not yet emerged. Although such close involvement with the flight paths of 
many aircraft early in a developing anomaly may be the safest option, it clearly 
carries costs in terms of decreasing throughput and increasing workload. 

5.4.3 The issue of intent 

The most important missing thing in the above scenario is knowledge of intent. If 
only the controller knew everyone's intentions, the situation would be easier to 
handle. Does this mean that the foremost system requirement should be that "the 
controller needs to know intent"? From the data, it seems not. Finding out what 
every aircraft's intentions were was deemed to be demanding and perhaps costly to 
system efficiency. This means that the requirement that "the controller needs to 
know intent" is too coarse. It does not take into account that knowing individual 
aircraft intents can be impossible under the constraints and competing attentional 
demands of escalating problem situations; it ignores the fact that knowing every 


of any conflicts as a result. 
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airplane's individual intent is orthogonal to facilitating more throughput in the 
airspace, and finally, it may not capture how intent can be the product of complex 
interactions between aircraft that are recognized on the basis of prior exposure to 
similar situations. r 

Rather, the question of what or whose intent should be known or communicated, 
must be made context-sensitive. In particular cases, such as the nordo aircraft, it 
would be really helpful to know that airplane's individual intent; without knowing 
that, it may be less relevant and even intrusive to hear what all the surrounding 
traffic is doing. Walkthroughs of future incidents revealed that controllers face 
multiple trade-offs and must reconcile constraints that stem from many sources, 
such as safety, workload, throughput, and economic interests of a carrier. The 
requirement that intent be sensitive to the problem-solving context captures more 
of the variety of pressures and competing demands inherent to escalating situations. 


Recommendation 1: Instead of defining a requirement "the controller needs 
to know intent", it needs to be explored how communication of intent can be 
made sensitive to the problem-solving context. Knowing and 
communicating intent in future airspace environments will be subject to 
various pressures (e.g. problem escalation; controller workload; efficiency). 

The question, of course, is how to make the communication of intent sensitive to 
the problem-solving context. ATC is an expertise-intensive activity. Controllers 
seem to have little trouble defining the kinds of intent they need to know at 
particular moments during an evolving situation (i.e.: "do you see that traffic?" or 
"say indicated airspeed") and usually have no qualms about asking for it. 

Another implication of the fact that intent may not be known (and this will be a 
characteristic of more flexible air traffic environments) is wider distribution of 
knowledge and information. Some participants have bits and pieces of knowledge 
necessary to solve a particular problem, and so do others. This emerged from the 
nordo aircraft scenario as well. Thus, future air traffic architectures must support 
the robust exchange of knowledge. 

Recommendation 2: Given the wider distribution of knowledge, the 

importance of robust and context-sensitive communication channels must be 
acknowledged early in system development. In particular, it should be 
investigated what kinds of information flows between ATC to AOC are 
necessary to support the integration of two sets of goals (the arbitrator's (ATC) 
and the stakeholder s (AOC)) in determining an airplane's safest and most 
economical path. 

Intent is not necessarily the reflection of quantifiable, or otherwise easily measured 
data (such as a final destination, or a particular altitude, or a velocity vector). 
Accordingly, the recognition of what requires intervention is not necessarily as 
simple as checking a single datum. Decision makers in natural contexts tend to let 
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their responses be driven by the recognition of patterns in their fields of activity (see 
Klein, 1993; Orasanu & Connolly, 1993). They recognize situations in terms of their 
relevant cues and typical actions (Klein, 1993). This simplifies the question of when 
(and what kind of) intervention is necessary: pattern recognition often triggers one 
response from a limited repertoire of strategies that have been well-rehearsed over 
years of operational experience (Sarter & Woods, 1992; 1994) 

Various future problem-solving situations were presented to controllers; they 
contained different situations in which traffic started forming recognizable patterns. 
In one scenario, for instance, aircraft inbound for a major airport encountered a line 
of thunderstorms. Rather than judging or inquiring about movements of 
individual airplanes, controllers recognized the funneling of aircraft (in order to go 
through holes in the weather) as the pattern that gave rise to the need to intervene. 
This indicated that controllers may rely on the recognition of patterns in their 
operational world, and that they classify situations to ascertain the proper response 
to them: 

• "a problem like this" 

• "you're basing it on a known situation" 

• "in this scenario" 

• "in this case" 

• "we see this on a daily basis" 

A typical way of responding to the thunderstorm case was to take control over the 
incoming waves of traffic and guide them through the holes one at a time, thus 
ensuring safe separation within waves while spreading the controller's workload 
over time. 

Another response that was examined in this research centered around a proposal by 
RTCA (1995) to take under control only those aircraft that presented the most 
pressing problem, and to ask surrounding traffic to circumvent the area or enter 
only after receiving a clearance. With this strategy, operators of surrounding aircraft 
can choose the best option based on their economic assessment. Thus this strategy 
has the potential to balance safety issues, an operator's economic interests, and 
controller workload. Problems with this strategy arose in relation to flight crews, 
who must be made aware precisely what piece of airspace is under tighter control. 

Recommendation 3: Explore the feasibility of dual strategies of control 

under more flexible air traffic management: i.e. taking only those aircraft 
under control that present the most pressing problem and asking 
surrounding traffic to circumvent the restricted area or enter it only after a 
receiving a clearance. Specifically, investigate: 

• How boundaries of tighter controlled areas can be identified by 
controllers and communicated efficiently and unambiguously to flight 
crews (e.g. by portraying them on navigation displays with annotated 
altitude information) 
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• How dual strategies such as these can have a role at a more strategic 
(and pre-flight planning) level, when ATC indicates in advance which 
airspace areas are likely to be relatively restricted and which are not. 

With initial evaluation of these dual strategies, problem solving strategies of 
practitioners suggested that they would rely on the recognition of frequently 
occurring traffic patterns to judge whether or not the RTCA strategy would work. 

One of the implications of pattern recognition and reliance on prior experience is 
that a criterion for intervention (and the determination of what kind of 
intervention is necessary) is empirical, i.e., based in part on past exposure to similar 
situations. This may mean that decisions of when and how to intervene are, to a 
degree, subjective and that many different responses can fall within the same 
definition of "safe separation" under free flight rules, although what is actually 
permissible may well vary by controller, by day, by sector or by center (see 
recommendation 7). 

If recognition-based anticipation of problems is indeed among the dominant 
strategies used in judging what situations require intervention, then it becomes 
crucial to examine how more flexible air traffic worlds might change the signature 
of air traffic behavior and whether this would aid or reduce a controller's ability to 
recognize patterns or particular types of situations "on a daily basis". Controllers 
express concern about this as follows: 

• "In free flight, nothing is preset. You will have to scan all the time. In the 
current system there are confliction points where you expect flows to cross on 
a daily basis. You focus on confliction points. But in a free flight 
environment, everything is a focus point." 

Similarly, initiatives toward adaptive resectorization (RTCA, 1995) in free flight 
must be evaluated in terms of their impact on how a controller can rely on prior 
experience to solve problems in his airspace. Increased diffusion of airplanes and 
changing sector boundaries could lead to surprises and novel situations that may 
defy a controller's earlier familiarity with problems in his or her sector. 

Recommendation 4: Evaluate the extent to which more flexible air traffic 
management will affect the regularity of traffic flow patterns and the 
occurrence of typical, easily recognizable problems within particular sectors. 
Examine whether adaptive sector boundaries would present controllers with 
a larger number of novel problems. 

Several issues related to the data gathered in the first study deserve some attention 
here. Practitioners were not provided with (informational) flight paths of all aircraft 
(whether these aircraft were relevant to the problem or not) as would actually be 
part of RTCA's (1996b) version of free flight. Also, it was not clear to controllers that 
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they will be informed whenever changes in such an informational flight plan take 
place. In these senses, controllers were led to assume a more extreme version of the 
future world than RTCA's (1995) proposal envisions. This means that there are 
several issues related to specific scenarios that may be worth examining further. 

Recommendation 5: Conduct future incident studies with participants of 

various backgrounds (pilots, controllers, dispatchers, flow controllers) while 
exploring the following conditions: 

• Participants are made aware in advance of the proposed RTCA rule 
that informational flight plans will be available and that these will be 
updated as soon as local agents make changes; 

• Participants are provided with these more detailed flight plans of the 
airplanes that are in their sector in the scenario. What could be ways to 
provide this so that it resembles the practitioners' world, where they 
are caught up in time-paced, evolving operations? 

• Under the above two conditions: an aircraft suffers a communication 
failure immediately or shortly after announcing a change to its flight 
plan (so the uncertainty about what it might do is re-inserted). 

In examining these additional questions, it is important to understand that the data 
generated in the current study are neither high-level discussions (i.e., open-ended 
elicitations) nor true protocols from time-paced simulations, but that as reports or 
traces of problem-solving they fall somewhere in between. Practitioners were 
bound to a concrete problem-solving protocol, but not set in an event-driven 
simulation. This can be seen as a first step on the road toward meeting the 
challenge of investigating future worlds. The criterion at this point is that the 
interpretation, of what makes recognizing exceptions a difficult judgement, speaks 
to the data at hand. Furthermore, there are not many competing ideas (not even 
within the supervisory control literature) that discuss in detail the kind of 
distributed and cooperative problem-solving between cognitive agents that was 
encountered in the future world of free flight. For subsequent investigations of 
future system architectures, however, it is important that consideration be given to 
incorporating the event-driven nature and real-time deadlines typical of the 
domain of air traffic control. 

Recommendation 6: Explore ways in which the event-driven and time-paced 
characteristics of the domain of air traffic control can be incorporated in 
further future incident studies. 

5.4.4 The criteria for success and failure in the future system 

The nordo scenario exposes the difficult question of what counts as over- 
intervention and what as under-intervention in management by exception, and 
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what counts as success and what as failure. As in the example above, does 
intervening early also mean over-intervention? It may be considered a success if an 
unsafe situation was avoided, but from an efficiency or throughput perspective such 
early intervention might represent a failure of the system to function well. The 
problem with early interventions is that they may tend to eradicate any evidence 
that an unsafe situation was indeed imminent: after having intervened it may be 
difficult to ascertain that an anomaly was actually developing and that the 
intervention was justified. 

On the other hand, if a controller takes over only after an alert has been issued by an 
airborne collision avoidance device, this could be thought of as a late intervention. 
But is it also under-intervention? In other words, does the issuance of an alert 
mean that the system is functioning well and efficiently, and that no airplanes are 
unnecessarily interfered with? Or does it mean that the system is operating at the 
margins, closer to potential breakdown? Again, the answer may depend on one's 
perspective, but in this study both controllers and pilots expressed concern about late 
interventions: 

• Controller: "By the time I get the alert, separation is already gone." 

• Pilot: "You don't want to be in a position where you have to rely on your last 
line of defence, where you're ricocheting off each other." 

Because of the nature of management by exception, the determination of when to 
intervene is subject to different pressures. Practitioners at the sharp end 
(controllers, pilots) have stakes in choosing the option that is likely to most benefit 
their safety. However, activities of these practitioners involve other sets of goals as 
well: system throughput (for controllers) and an airline company's economic 
interests (for pilots). Early (perhaps safer) interventions can jeopardize these goals. 
Restricting an aircraft's flexibility, for instance, can increase the uncertainty about 
what may happen to company goals such as timely arrivals or fuel savings. 

Recommendation 7: The criteria for controller intervention appear to be 
formed on the basis of various considerations (safety, throughput, workload, 
empirical factors). There is need to investigate further what criteria for 
intervention will be emphasized in specific future air traffic environments 
and how these criteria are established as a result of operational experience. 

5.4.5 System learning 

The issues about setting a criterion for intervention and what counts as over- or 
underintervention raise another question. How does a management by exception 
system learn from its own performance? As explained earlier, the very act of 
intervening may destroy the opportunity to learn. Would an anomaly have 
developed if intervention was delayed or not initiated at all? There may be no way 
of concluding this from individual cases, so for the air traffic system to know how 
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well or poorly it is doing, it must be able to compare across multiple interventions. 
This requires some sort of system memory (and a mechanism for information 
sharing) that tracks the kinds and number of interventions (by sector, or center, or 
airline, etc.). The contents of such a memory will likely have to be measured against 
different criteria in order to arrive at indications of performance, such as airline 
economic interests on the one hand and separation standards on the other. 

Recommendation 8: In order to learn from its own performance, relative to 
safety or economic targets, the air traffic system will require some kind of 
memory, so that multiple cases of interventions can be compared. Studies are 
needed to determine (1) what the precise contents of such a memory should 
be (e.g., Interventions per se? Only separation conflicts? Or all automatic 
conflict resolutions?), (2) against what yardstick the contents of such memory 
must be compared: e.g., safety or economic targets (but note the dichotomy of 
what counts as over- and underintervention, depending on the perspective 
one takes) and (3) how such a memory can be made organizationally feasible 
(given confidentiality issues, possible pressures not to report in cases of safety 
breaches, etc.). 

5.4.6 Success and failure in cooperative, distributed systems 

Free flight in general, and this research in particular, shows that when knowledge, 
authority, and points of view of an evolving problem are distributed across various 
participants in a system, a large burden is placed on the effectivity and robustness of 
mechanisms for sharing information. But effective sharing goes beyond providing 
robust channels: it must be sensitive to the fact that cognitive activities in dynamic 
systems ebb and flow as well, and that knowledge that is available somewhere in the 
system is not necessarily accessible elsewhere, given workload or other pressures. In 
many situations it is easy to observe that the most information sharing is necessary 
when workload and competition for attentional resources are already high. 

It is important to note that in relation to these issues, we must shift our viewpoint 
from thinking of one practitioner as crucial to the success or failure of a system, to 
thinking of collaborative work as being critical to a distributed system's success. 
Conversely, failure in cooperative distributed systems is indeed that: a failure of the 
cooperative system to function effectively. There is much research to be done to 
enlarge our understanding of the causation and propagation of failure in 
cooperative distributed systems. Many failures in complex distributed systems are 
still attributed to a single "human error"; the failure of one practitioner to act in a 
certain way at a single moment during the incident evolution 

Although these attributions may be consistent with empirical facts in a narrow 
sense, they assume that an individual action can be excised from its context to 
produce a meaningful explanation of a chain of events that unfolded under the 
hands of multiple agents, both human and machine. Such explanations cannot 
capture the important information hidden in these incidents: failures in complex. 
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distributed systems are often the outcome of a series of miscoordinations and 
miscommunications, where inaccurate or inadequate mental models of the 
situation on the part of individual participants are built and fostered through their 
interactions with other agents in the system. A typical failure, that can be expected 
in an architecture such as free flight, is that all the information necessary to solve a 
particular problem was available somewhere in the system, but distributed in such a 
way that it was inaccessible to practitioners caught up in the evolving incident, or 
distributed in a way that was not encountered previously. Some of this is 
demonstrated in the incident with the nordo aircraft. 

Recommendation 9: Expand our understanding of success and failure in 

highly distributed, multi-agent systems, with an emphasis on the potential 
contribution of distributed information and/or knowledge (1) through 
retrospective investigations of incidents and accidents in various complex, 
distributed worlds, and (2) through examination of envisioned distributed 
system architectures by way of future incidents that pose challenges to the 
coordination and communication across multiple different system 
participants. 

5.4.7 Responsibility in cooperative, distributed systems 

If failures in complex system are a concatenation of multiple contributions, then 
who is responsible? It is commonly thought that if knowledge is distributed to an 
extent that everybody contributes to, and is partly responsible for, the propagation of 
a failure, then nobody really ends up being responsible. But this is inconsistent with 
findings from the future incident studies in this research. Distributed knowledge 
means distributed (in the sense of localized) responsibility: 

• Controller: "If I'm responsible, there's the caveat that I need to know what's 
going on." 

If controllers are to be responsible for separation, then they "need to know what's 
going on". In other words, no knowledge: no responsibility. This coupling of 
responsibility with knowledge is particularly interesting when the reverse question 
is asked. If there is knowledge, does responsibility automatically attach itself to it? 
Does responsibility travel with knowledge? Study participants pondered this 
question and found that they faced a dilemma. Controllers may not know how 
much or tittle another agent in the system knows; it is therefore uncertain how 
much authority should or can be delegated. 

The case of the nordo aircraft serves as an illustration once more. The question is, 
what does the nordo aircraft know? Can its collision avoidance system see the 
altitudes of surrounding traffic and thus generate a resolution advisory to avoid 
separation conflicts? Much discussion on what the nordo aircraft would or would 
not see turns out to depend on the type of collision avoidance system that is on 
board - something that is not known to controllers. One participant concludes: 
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• Controller: "Okay, if we know that this guy [the nordo aircraft] can see the 
altitudes of other airplanes then I would be a little less worried about him. 
Now if I don't know this. I'd be a little bit ... nervous, to say the least." 

Given enough time, there would be ways to find out how much the nordo aircraft 
knows (i.e., what type of collision avoidance system it has); controllers could contact 
the airline operations center, for instance. But this is unlikely to be feasible in the 
face of a rapidly deteriorating situation. Besides, there is no certainty that the crew 
of the nordo aircraft, even if equipped with the right system, has an opportunity to 
look at it, given the competing attentional demands brought on by multiple on- 
board malfunctions. As one pilot remarked: 

• Pilot: "It's hard enough to fly the airplane, now you're going to make me 
control myself and half a dozen others too?" 

The delegation of responsibility may thus be based on unsubstantiated assumptions 
about what other agents in the system know. This means that knowledge and 
responsibility are likely to become disjointed in certain cases, where one agent 
delegates responsibility on the basis of presuppositions about what the other agent 
knows, while the other agent actually lacks access to a critical piece of knowledge. 
The one agent can wait longer, as was shown earlier, to produce more evidence 
about what the other agent does or does not know about his situation. But this can 
lead to escalation and a loss of opportunities to recover from failure. 

5.5 Concluding Remarks 

Two main issues emerge from this study: (1) the complexity of management by 
exception and its implications for success and failure in highly distributed multi- 
agent architectures, and (2) the need for definition of system requirements early in 
the development cycle. 

5.5.1 The complexity of management by exception 

If we first go back to the questions asked about management by exception in the 
introduction, what contributions has this research made? 

Who notices the exceptions? The manager does. Exceptions are cases in which 
(subordinate) agents handle process anomalies in such a way that they may 
jeopardize a manager's system goals of safety, efficiency or adherence to regulations. 
As seen in the scenario with thunderstorms, pilots may handle process anomalies 
in a way that is consistent with their company's goals (e.g., no delays). When this 
pursuit is combined with actions of other airplanes, however, it may threaten the 
manager's overall system goals, something a pilot with a more local perspective on 
the problem is unable to see. 
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What is the manager looking for? The manager is concerned with problems that 
may arise in how other agents are dealing with anomalies in their process. 
Management by exception is inherently about the future. In order to protect his 
goals of system safety and efficiency and adherence to regulations, the manager must 
anticipate how agents' behavior may lead to problems. By waiting too long (e.g. 
until automatic conflict resolutions have been issued to aircraft) a manager 
effectively excludes himself from helping to solve the problem. Since individual 
intentions may at times be hard to evaluate in a future, more autonomous air traffic 
world, it was conjectured how a manager might rely on the recognition of recurrent 
patterns in his environment. In one study, pattern recognition was shown to be 
able to help a manager identify situations that called for intervention and to drive 
the selection of a known, well-rehearsed response to deal with the problem. 

What does a manager do to intervene? At first glance, it seems that a manager has 
many ways of intervening in how other agents are handling the process. He can 
wait for more evidence to emerge on exactly which agents will create the biggest 
problems; he can adjust the number of agents who are going to be affected by the 
intervention, and he can vary the extent to which he reins in their authority. But 
closer examination reveals that during an escalating anomaly the manager is rather 
constrained in what he can do. The three trade-offs he needs to make appear 
interconnected, and can end up putting him in double binds. Early intervention, for 
instance, may be a safe option to choose, but it carries costs in terms of lost 
throughput and high attentional demands. Intervening with fewer airplanes may 
turn out to be ineffective and potentially dangerous, since it may not be known (and 
is not controlled) what surrounding traffic will do. Finding out the intentions of 
surrounding traffic will again lead to competition for limited attentional resources. 
And the longer the manager waits with his intervention, so as to be positive about 
exactly who should be reined in, the less room and time he leaves himself to make a 
useful contribution to the problem with his higher-level system view. 

What about success and failure in management by exception? The original idea in 
supervisory control that there is only one trade-off to make (intervening versus 
gathering more evidence) and only one way to intervene (all or nothing) 
oversimplifies matters. The trade-offs that a manager faces in management by 
exception appear far more complicated and multifaceted. For example, taking total 
control in the future free flight incidents was thought impossible due to workload 
and throughput pressures. Success or failure in these kinds of systems is no longer a 
matter of intervening in time or not. Succeeding is striking a delicate balance 
between multiple trade-offs (how many aircraft; when; how deep an intervention?) 
and reconciling a variety of pressures (safety, workload, throughput, economic 
concerns of individual operators, etc.). And whether the outcome of an 
intervention decision is deemed success or failure will ultimately depend on the 
perspective that is taken. 


5-18 



5.5.2 Early derivation of human factors requirements 


This research aimed at evaluating the consequences of changes in technology and 
people's roles before large pools of resources were committed to particular system 
designs. By wedding timeless problems and constraints of the airspace environment 
with proposed procedures and envisioned technologies, future incidents were 
created. Together, these incidents constitute one method by which to quickly 
prototype and study how people and technology will coordinate in realistic 
operational scenarios for an envisioned air traffic management world (Smith et al., 
1996). The fact that system design is still underspecified during the early stages of 
development is accompanied by the potential to oversimplify the impact of design 
decisions on practitioners' roles and activities. This oversimplification was 
countered by the confrontation of multiple practitioner perspectives during the 
incident walkthroughs. In this way, the looseness in understanding of how future 
worlds are going to work is anchored in the details of coordination necessary to 
handle a concrete incident scenario. 

Thus, future incidents helped the early derivation of human factors requirements. 
For instance, through the cognitive walkthroughs of the nordo aircraft incident, it 
was possible to refine the requirement that "the controller needs to know intent". It 
was concluded that it is more meaningful to think about requirements of how to 
make the communication of intent context-sensitive. That is, how can designers 
ensure that intent is communicated in a fashion that is sensitive to the variety of 
pressures inherent to escalating problem scenarios? This example illustrates the 
worth of the use of these kinds of methods early in system development. 

Recommendation 10: Efforts should be continued to explore and refine 
methods that can identify human performance problems very early in system 
development, and that can generate meaningful human factors requirements 
without large investments in prototypes or other resource commitments. 
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6.1 Introduction 

As a result of a series of knowledge elicitation studies, it became clear that a central 
question in the design of an environment to support free flight during the enroute 
portion of a flight is a clear definition of what information will be required to make 
air traffic control decisions and an understanding of how that information is used. 
The answers to this question have major implications for the design of computer 
systems to assist with the detection and resolution of potential conflicts, for the 
identification of the information that must be communicated between pilots and 
controllers when pilots have assumed responsibility for maintaining separation, for 
the design of rules and procedures, and for the assignment of roles to flight crews, 
controllers and technology. 


6.2 Methods 

We conducted a series of structured interviews at an Enroute Center to explore this 
topic in more detail. Two site visits were made to an Enroute Center, where six 
controllers were interviewed. 

The following questions were used as the basis for structured interviews with 
controllers. (These interactions were tape recorded for later analysis.) The 
interviews were conducted on two separate occasions, based on the questions listed 
below. 
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6.2.1 First Interview 


Issue 1. It has been suggested that the expanded NRP is causing reduced capacity at 
some choke points because the increased complexity requires greater separation 
distances: 


• Question: If you are aware of such problems, are the increased separations 
due to an increased workload on the controller? If so, what factors contibute 
to this complexity? 

• Question: Could the problem be overcome by increasing the number of 
controllers, by dynamic sectorization, or by support technologies? 

• Question: What if we use technology to deal with this complexity in order to 
allow reduced separation and a situation arises that the technology can t 
detect or deal with? 

• Question: What implications would allowing enroute free flight have 
regarding the concerns raised by Issue 1? 

• Question: Could the concerns raised above lead to gridlocking a sector? What 
is the price paid when this happens? 

Issue 2. What are the factors that an agent (human or computer) must consider in 
deciding whether a route or altitude change is acceptable? 

• Question: How do the following factors influence such decisions 

a. Positional uncertainty 

a. Weather 

b. Response times 

c. Knowledge of intent 

d. Traffic density and complexity 

e. Predictability of traffic patterns 

f. Availability of contingency plans 

6.2.2 Second Interview 
6.2.2.1 Weather Issues 

• Question: What kinds of information do you have available to you about 
weather? 

• Question: Can you give me specific examples of situations where weather was 
reported by one pilot and how you then handled other flights in the same 
area based on that pilot report? 
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• Question: Can you give me specific examples of how, after watching weather 
develop, you began predicting how other flights would be affected by it? In 
such situations, what contingency plans do you have to think about? 

• Question: What are the implications for information exchange in these 
situations? 

62.2.2 Knowledge of Intent 

• Question: Can you give me examples of cases where there is a great deal of 
uncertainty about what a pilot will actually do in the near future (due, for 
example, to uncertainty about an immediate weather problem)? 

• Question: When pilots are flying around a storm, how detailed is your 
knowledge of the path they will actually fly? 

6.2.23 Traffic Complexity 

• Question: Can you give me examples where the amount of traffic increases 
complexity? 

• Question: Can you give me examples where the predictability of confliction 
points (both where and when) affects complexity? 

• Question: Can you give me examples where you can recognize/ categorize the 
situation and have preplanned solutions, such as using holding patterns, to 
deal with the situation? 

• Question: Can you give me examples where the mix of aircraft increases 
complexity? 

• Question: Can you give me examples where the experience and skill of the 
controller influences his or her ability to deal with complexity? 

• Question: Can you give me examples where the communications workload 
increases complexity? 

6.2.2A Positional Uncertainty 

• Question: Can you give me current world examples of positional uncertainty 
such as navigational error, measurement error, display accuracy? 

• Question: Can you give me examples of positional uncertainty that could 
still arise in a future world with GPS and other advanced technologies? 
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6. 2.2.5 Planning for Contingencies 

• Question: Can you give me examples where you explicitly plan for 

contingencies when you believe a situation could become critical? 

• Question: What are the implications for communications? 

6.3 Subjects 

Six controllers were included in the structured interviews. Demographic data on 
these controllers are shown below. 

Controller #1: Years as a controller: 15 

Pilot: flight instructor, commercial pilot with 2000 hours of experience 
Other aviation jobs: flight center manager 

College: three years of study at Embry-Riddle Aeronautical University 

Controller #2: Years as a controller: 11 
Pilot: no 

Other aviation jobs: no 
College: no 

Controller #3: Years as a controller: 15 years 
Pilot: no 

Other aviation jobs: Air defense operator while serving in the Air Force 
College: no 

Controller #4: Years as a controller: 14 years 
Other aviation jobs: no 
College: no 

Other jobs: Worked as an emergency medical technician for six years 

Controller #5: Years as a controller: 18 years 

Pilot: yes, with single engine aircraft rating 

Other aviation jobs: first line supervisor, area manager, assistant manager for 
airspace and procedures, manager for procedures and automation 
College: no 

Other jobs: military experience with radar and electronics maintenance 

Controller #6: Years as a controller: 28 years 

Pilot: yes; ATP, flight instructor, single/ multi engine and instrument, 
helicopter and glider, commercial privileges, single engine land and sea 
Other aviation jobs: first line supervisor 
College: degree in business 
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6.4 Results and Discussion 


The findings from this data collection effort are categorized below in terms of the 
types of knowledge and information necessary for controllers to effectively complete 
their tasks, and in terms of the implications of these requirements for developing 
an effective enroute free flight environment. 

6.4.1 Factors Influencing Decision Making 

Five factors were identified as important in making decisions to ensure safe routing 
and separation of aircraft. Each factor is described below, with examples indicating 
its significance for the design of an enroute free flight environment. 

6.4. 1.1 Weather Avoidance 

Weather, in part, determines which alternatives are acceptable for amending a flight 
plan. At present, access to this information is distributed between the controller and 
the flight crew, and both must contribute their information when making a 
decision. According to the information gained from our interviews, the controller 
has access to five different types of information about weather. They include: 

Weather displays on radar screens (local weather); 

Verbal pilot reports; 

Weather monitors (displays with National Weather Service broadcasts); 
Teletype weather reports; 

Pilot reports (PIREPs). 

Weather Displays: Weather can be displayed on the same radar scopes used to track 
aircraft. The precipitation which is shown is medium to high in intensity due to 
the fact that it comes from digitized radar. These weather displays deal only with 
airborne precipitation, and may be inaccurate as sometimes heavy moisture in the 
air can be displayed as precipitation. They do not show weather cells and sometimes 
miss precipitation. Further, that precipitation must be of at least a minimum 
intensity to be displayed due to the digital nature of the information. The weather 
radar is different from the radar which shows the position of airplanes, but uses the 
same system. This type of information does allow the controllers to build a mental 
picture of the weather situation. This mental picture is, however, incomplete, as 
one controller reported: 

• "We sketch in our minds where the real storm is at [sic], but it constantly 
moves, it grows, it dissipates, so we rely on pilots to tell us where they go to 
avoid it." 

Verbal Pilot Reports: As suggested in the quote above, much real time information 
about weather is relayed via verbal communication with pilots who have just 
flown through or around the weather in question. Controllers often solicit verbal 
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pilot reports to confirm the weather situation. Conversely, pilots sometimes 
request weather information from controllers. To gather this information, the 
controllers: 

• "Ask another pilot who has just been through that area what's there. We 
also ask what's developing so we can predict what's happening." 

Weather Monitors: This information is relayed via the National Weather Service. 
There is one weather monitor per geographical area, and this information is 
gathered by radar. Typically, the jet routes are not projected on this weather display, 
so controllers: 

• "Put them on in your mind. Sometimes you can put jet routes on but it gets 
cluttered. A zoom feature exists, but when you are busy you can't get to it. 
We use it for general observation only. And we can't always view it from our 
scopes." 

Teletype Weather: The FAA service sends weather information to enroute centers 
on a regular basis. The weather information contained in these teletypes is in text 
format. 

Pilot Reports (PIREPs): If a pilot experiences significant weather and believes that 
other pilots should be aware of it, he or she may file a PIREP. A PIREP is an official 
weather report which is then broadcast via the center's service to the affected area. 
PIREPS are often the only source of information about certain weather phenomena 
such as clear air turbulence. 

Use of Weather Data: These weather reports from different sources are important 
information for controllers and help them predict how traffic patterns will be 
affected by the weather. To deal with this weather data, the controller tries to take 
advantage of his or her past experience to anticipate the likely time course of the 
weather disturbance, and to select appropriate solutions for rerouting aircraft. As an 
example: 

• "We can determine if a cell groups and blocks off an airway. We have to start 
rerouting airplanes so they don't get to it. When we do that we put more 
miles-in-trail restrictions to have fewer planes. We can ask for a ground 
delay if they're not airborne or give larger deviations if they're enroute or on 
a delay vector. Airborne holding is avoided in this scenario. The closer you 
get to a terminal area, the more you use holding. Given where the weather 
is, if it's right over New York, then we would hold here in our [Clevelandl 
Center until the weather passes. If weather is in between [the airplane and its 
destination) we try to get them around it. The direction of the flight is a big 
factor. If they (the aircraft] are going West, then you don't want to hold 
[them], as the weather will pass through them. If [it's| going East, we let the 
weather pass the airport and then we go in." 
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Similarly, the distance of a flight from its destination affects how the controller 
handles that flight in adverse weather: 

• "Another problem is winter storms. What do you do if a runway closes or a 
plane goes off a runway? That's where you use your holding now. Airports 
try to give us a heads up time, if possible, for plowing the airports, but the 
agency doesn't make the call on runway closings. You go into holding status 
throughout. If planes are on the ground, you keep them there. The increased 
workload and traffic volume depends on where the planes are at. If they are 
close to their destination, you put them in the stack and pull them out when 
you can. There may be major complications though. There may be icing 
when trying to hold or deviate. You may be able to take them higher to get 
out of an icing condition, but the decision to divert is an economic one and it 
stays with the user. We only make suggestions. A similar situation could 
occur if an ILS fails at the last minute, if an approach loses its radar, or if the 
weather is marginal." 

Past experience does not always, however, give the controller enough insights about 
how the weather will develop to make use of preplanned "canned" solutions: 

• "Each context is different when it comes to weather. It depends on the 
severity, the height, the length. For instance, if it's a couple of hundred 
miles, they'll go around it. If it's 800 miles, you pick your way through it and 
then it is a bumpy ride." 

An illustration of this: 

• "is the O'Hare inbound push from the Northeast. If there's weather 
everywhere and everyone is deviating, we're trying to get 15 miles-in-trail 
and the planes down to 31,000 feet going into Chicago. Meanwhile O'Hare 
departures eastbound are supposed to be 60 to 80 miles south of the arrival 
traffic but are deviating into the inbound traffic to the north-into a sector that 
[usually] never sees them. That controller has no information as they are 
deviating too quickly. The traffic is climbing and descending head on at two 
Center boundaries. This happens one to two dozen times a year, anytime you 
have thunderstorms in the Midwest in the heart of the afternoon traffic. It's 
the heaviest traffic period due to the flight times. There's no canned solution 
as it's too complex. We may use swap routes --take departing traffic way 
north, but we can't do that when thunderstorms are there." 

A similar challenge arises because pilots differ in their assessments of risk: 

• "When we've got an area of weather, whoever is number one does it first. 
Some will follow, others won't. We just let them pick and choose what they 
want." 
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Finally, there is an interesting example of cooperation. When confronted with 
storm activity, pilots do not necessarily precisely report their course change: 

• "As for decisions to get them back on path, they let us know when they are 
clear of it and then they get back on their path." 

This strategy works in areas with low traffic density. However: 

• "It is a problem if everyone deviates and then tries to go direct to get back on 
path. You have to have some semblance of order, especially if the aircraft are 
coming into the terminal area. There you need more structure than 
enroute." 

Finally, weather may have strategic implications. Although the weather in a 
particular sector may be fine, weather further along the intended flight path (as well 
as other problems such as airport restrictions) can have implications for decisions 
about how to amend a flight plan: 

"We start making decisions when we see weather build. We decide how 
close we let them get to it. Planes leaving California for New York with 
thunderstorms in Ohio — we would reroute them when in the Midwest, 
maybe taking them through a south routing." 

Implications of Weather Considerations for Designing Procedures and 
Technologies: The RTCA (1995) report on Free Flight proposes that controllers be 
allowed to delegate separation authority to a flight crew when the situation permits. 
Under such enroute free flight conditions, the flight crew then has the 
responsibility to ensure safe separation, with the controller acting as a safety net 
(monitoring the situation and intervening as necessary). There is also an 
assumption that technology will play a role in such a system, monitoring for 
potential conflicts. In essence, this scenario implies that pilots flying under free 
flight rules must take on the role of the controller. The discussion above about the 
use of weather data by controllers has important implications for this scenario. 

First, the flight deck will have to have access to all of the pertinent data (weather 
and traffic) in a timely fashion, with an adequate field of view. Second, since in the 
foreseeable future technology cannot be expected to reason adequately about the 
potential impact of weather on conflicts, the flight crew will have to take over this 
responsibility from the controller. This means that the flight crew will have to 
reason about uncertainty in the weather and about how other flights will deal with 
the weather, and will have to plan contingencies for various possible occurrences. 
With regard to weather considerations, technology can at best provide decision 
support. The flight crew would have to integrate weather considerations into their 
final decisions. For example, if a number of flights was approaching a gap in a 
storm, intending to shoot through it, each crew would have to consider how they 
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would deal with the situation if the gap closed or if one or more of the other flight 
crews decided they did not want to continue through the gap. 

Alternatively, the concept proposed by the RTCA report to restrict enroute free 
flight when the volume and complexity of traffic is too high could be extended to 
weather situations. In short, to reduce the complexity of the flight crew's task and to 
take advantage of the expertise that controllers have about the development of 
weather situations in their sectors, free flight could similarly be restricted in areas 
experiencing complex weather phenomena. 

6.4.1.2 Knowledge of Intent 

There are three cases that must be considered regarding the communication of 
intent. The first is when a flight plan entered into an FMS is being flown. In this 
case the intent can be communicated by that flight's computer to another computer 
or another person (though this is not done at present). A second case is when the 
plane is being "hand flown" by the pilot. His or her intent may be communicated 
verbally at an abstract level ("I'm going to pass around the storm to the south"), but 
the exact path is not known to the controller. 

• "When a plane goes around a cloud his intent is known, but his true path is 
not known." 

The third case occurs when a flight plan entered into an FMS is being followed, but 
it has not been updated to reflect a soon-to-be-necessary deviation (around a storm, 
to avoid traffic, etc.): 

• "I'm going to change his route to avoid a storm, to accommodate other traffic. 
Or, if an airport is closed, he's going to have to hold or divert." 

In such cases, the flight crew may have the information necessary to understand the 
implications of a developing situation well before any change of intent is reflected 
in the flight plan in a form that a computer can process. This can be problematic in 
terms of coordination in a free flight environment: 

• "To have the big picture you need to know intent. Not knowing where the 
path will be can be a problem. If I change your path and another plane turns 
quickly, then we're back into trouble." 

Implications of Knowledge and Intent for Roles and Responsibilities: As with the 
discussion regarding weather phenomona, it is clear that this analysis regarding the 
communication of intent implies that there will be situations where the FMS 
system will not adequately communicate the likely path of a flight, either because 
the flight crew is hand flying the plane around a storm or because there is some 
upcoming disturbance that may require a route change, but that change has not yet 
been entered into the FMS. The net result is that, if the flight is flying under 
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enroute free flight rules, the conflict detection technology will have to be treated as 
only one source of data for the flight crew, who will have to access and integrate all 
of the available data, as controllers currently do. 

As with the discussion of weather above, an alternative is again to limit conditions 
where enroute free flight is allowed. For instance, one approach would be to 
suspend free flight anytime a flight deviates from its FMS programmed route, or 
where a complex situation exists in which significant short-term changes in route or 
altitude are possible. 

6.4.1.3 Knowledge of Traffic Density and Complexity 

There are many factors that influence the complexity of a traffic situation. 
Whatever agent is responsible for making decisions about a flight amendment 
(pilot, controller, or computer) must consider the impact of any decision on the 
complexity of the situation at that point in time or further along the flight path. It 
is clear that complexity is a complicated construct: 

• "Complexity always varies with the number of aircraft. There's a minimum 
service time per aircraft: The frequency of communication - you've got to 
check 'em off and on (establish initial contact and hand them off to the next 
controller). There's a set evaluation time, a set minimum time to evaluate 
for potential conflicts. There's a minimum scan time on every airplane and 
minimum mental time for each plane. Complexity is that times the number 
of aircraft. That makes a maximum number of planes you can handle." 

• "Speed variations among aircraft will make this more complicated. For 
example, when you try to do in trail [separation] with an MD-11 and an MD- 
80. the MD-80 is a lot slower, but you don't have room to let the fast one go by 
and you have to keep miles in trail." 

Complexity is also affected by the ability to predict where confliction points will 
occur: 


• "In the future, free flight will increase the service time, as nothing is preset. 
You will have to scan all the time. Confliction points are based on known 
intent and regular patterns of behavior. They are where flows cross on a daily 
basis. They are the only spots you concern yourself with. You focus on 
confliction points, but in a free flight environment, everything will have to 
be a focus point." 

Complexity is also influenced by such knowledge of confliction points, as the 
controllers can often make use of pre-planned strategies for handling particular 
routine patterns of activity: 
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• "Six out of 10 times you do the same thing for confliction points. You've got 
two converging airways that go into one and you've got to put planes in trail 
and you know if you turn one line 30 degrees, then they fall in 10 miles in 
trail. Or instead of turning, you reduce and/ or increase the speed of the other 
line, and then the converging lines of planes are put in trail." 

Implications for Flight Crews and Controllers: Traffic complexity issues in a free 
flight environment pose interesting challenges. First, if we accept the claim above 
that controllers successfully deal with complex traffic because there is predictability, 
then: 

1. System designers need to be concerned with how a potential decrease in 
predictability under enroute free flight will be dealt with by controllers; 

2. Flight crews presumably will need some technological substitute for the 
knowledge that individual controllers currently possess regarding confliction 
points and rule-based strategies for dealing with recurring situations within their 
particular sectors, as individual pilots cannot be expected to have sufficient 
experience with such patterns in specific sectors. 

As with the previous discussions regarding weather and knowledge of intent, the 
alternative is to restrict free flight wherever the situation is expected to become 
complex enough to raise concerns. (This is consistent with the concept of "dynamic 
density" in the RTCA report.) 

6.4.1.4 Planning for Contingencies 

One controller discussed how the development of contingency plans are an integral 
part of his work: "99.5% of the time you have contingency plans." 

As an example, another controller reported that, if he knew there was a single hole 
in a storm front through which he would have to move a line of air traffic, he 
would do the following: 

• "The smart controller will opt for altitude separation. I can't control where 
they will have to fly in this situation, so 1 separate them by altitude. No one 
is at the same altitude. A controller also has to have Plan B in case a pilot 
refuses a directive. If more than four or five planes abreast are going for one 
hole, then I haven't done good pre-planning. If I run into further problems, I 
try turning the following aircraft back 20 degrees or 90 or 180 degrees to avoid 
a conflict. This helps in addition to moving the planes in a "line" to different 
altitudes in case someone backs out." 

Implications of the Need for Contingency Planning: If enroute free flight is allowed 
in situations where significant contingency planning is required, then the flight 
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crews will have to somehow coordinate with each other (perhaps with the 
mediation of a controller) to ensure that suitable contingencies are available. 


6.5 Conclusion 

The points raised in these interviews make it clear that the job of the controller is a 
challenging one that requires a variety of reasoning about diverse situations. Much 
of the communication, whether about intent or contingencies, at present is not in a 
form which is easily input to a computer. Furthermore, while the ability to 
recognize typical situations helps the controller to recognize when he or she can use 
solutions which have proved reliable in the past, the complexity of the work 
requires constant evaluation by the controller to ascertain whether the current 
situation is sufficiently analogous to previous ones to know whether a pre-planned 
solution is appropriate. 

The implication of this analysis of a controller's job is that, if enroute free flight is to 
be allowed, then either: 

1. Flight crews will have to take on many of the challenging aspects of a controller's 
job while they are in free flight, requiring them to: 

a. Have access to ail pertinent weather and intent information currently 
available to controllers, in voice and/or digital form; 

b. Develop the knowledge about particular sectors necessary to recognize and 
efficiently resolve conflicts; 

c. Communicate and coordinate with other flight crews and controllers when 
implementing flight path amendments. 

Because many important considerations will not be accessible to the computer, 
technology will at most provide a source of information that flight crews must then 
integrate in order to make decisions. 

2. Alternatively, the RTCA concept of restricting free flight based on dynamic 
density will have to be refined to include consideration of factors such as 
weather, knowledge of intent and contingency planning. One implication of 
this is that controllers and traffic managers will have to have effective tools for 
dynamically defining regions where free flight is restricted temporarily, and 
methods for communicating these regions to flight crews and AOCs. 
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7.1 Introduction 

In some proposals for a future ATM system, pilots are assumed to have the option 
to dynamically adjust their flight path in response to a variety of factors such as 
changing environmental or aircraft conditions or to comply with company requests 
(RTCA, 1995). They will be able to do so without the need for approval from the 
ground. Notification of ground personnel of pilot-initiated actions may be 
recommended or required but there is no agreement yet concerning the timing of 
those notifications. As discussed by Billings (1996), some groups propose that 
"position and short-term intent information is provided to the air traffic service 
provider" (RTCA, 1995). Others, however, suggest that "subsequent to any change, a 
revised plan will be data-linked to the ground system for planning purposes" 
(I AT A, 1994). 

In other words, information on pilot-initiated actions may be available to ground- 
based operators only concurrently (as aircraft behavior is observed on the scope) or 
after-the-fact (once notified by the pilot). As a result, the likelihood of sudden 
unpredictable changes in traffic configurations and the need for immediate yet 
coordinated intervention in ongoing operations can be expected to increase for both 
pilots and controllers who are expected to share responsibilities for critical tasks such 
as aircraft separation. To support both pilots and ground-based operators in this 
highly dynamic, reactive approach to traffic management, practice- or use-centered 
communication technologies and procedures need to be developed that match the 
strategies, abilities, and needs of humans and machines and that take into 
consideration the various demands associated with different task contexts. Efficient 
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air-ground communication needs to be supported by these systems in the interest of 
aiding the rapid creation and updating of shared frames of reference among all 
participants in the air traffic system. 

As a first step in the design of practice-centered systems and procedures, the purpose 
of and the demands associated with communication in future air traffic operations 
need to be identified and analyzed. Currently proposed system interfaces and 
protocols for digital and voice communication in the future ATM environment 
need to be examined in terms of their ability to effectively support those objectives 
and demands. First steps towards these goals were taken in the context of this 
project by means of conceptual walkthroughs involving pilots, controllers, and 
dispatchers. These groups served to simulate future air traffic management 
operations, especially in the context of highly dynamic high-tempo situations such 
as the transition from Free Flight to a more controlled environment or the need for 
immediate action for collision or obstacle avoidance. 

These situations were chosen in part because they impose particularly high 
demands with respect to timely and efficient air-ground communication and 
coordination. Participants in these focus groups were asked to play out their likely 
roles in the future ATM environment to identify potential problems and to discuss 
possible solutions. This report discusses the communication-related issues that 
were raised in the context of those sessions. It also reviews the literature on 
experiences with currently proposed interfaces and protocols for digital 
communication and discusses their implications for future air traffic management 
operations. ° 


7-2 The Purpose and Demands of Communication in 
Current and Future Air Traffic Environments 


In the current ATC environment, the role of communication can best be described 
as a process of continuous mutual creation and recognition of commitments to 
actions (Austin, 1962; Winograd and Flores, 1986). Controllers play a fairly active 
role in communication in the sense that they initiate most contacts to issue 
clearances to aircraft under their control. These clearances have to be acknowledged 
and complied with by the crew. In turn, pilots can rely on controllers to ensure 
aircraft separation by indicating required actions or maneuvers for conflict 
resolution to them unless and until responsibility for this task is explicitly shifted 
from the ground to the flight deck. To maintain predictability and to support long- 
term planning of air traffic operations, pilots in the current environment can not 
change their flight path without approval from the ground, except in an emercencv 
situation. 67 

In contrast, some visions for future ATM operations do not call for firm 
commitments to actions. While long-term flight plans will likely be provided to the 
ground-based operator, pilots may be allowed to dynamically change their flight 
path at any time without approval from or coordination with the ground. Routine 
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communication will, in most cases, be initiated by the flight crew with the goal of 
providing the ground-based operator with information on pilot-initiated actions at 
the time of or immediately after-the-fact. Controllers are expected to communicate 
with flight crews primarily to resolve emerging conflicts or to respond to pilot 
requests. 

In the current system, mutual cognitive environments and shared knowledge are 
established and continuously updated. What has been said by a pilot or controller is 
assumed to be known by the other person and is built upon in future exchanges 
(Krauss and Fussel, 1990; Clark and Brennan, 1991). This allows air traffic 
controllers to determine and anticipate the behavior of aircraft under their control 
and to issue conditional clearances which are based on earlier agreed-upon 
commitments by other aircraft. In a time-critical situation that requires controller 
intervention, the controller already possesses the relevant knowledge that is 
necessary to develop and implement a solution to the given problem. 

In contrast, in the future air traffic environment, controllers may have to first 
gather information on everybody's status, activities, and intent before they can start 
working the observed or anticipated problem. Additional verbal explanations or 
reformulations in the interest of ensuring mutual understanding and grounding 
are known to be costly in time-constrained situations (Bressolle et al., 1995) but may 
become necessary in the future. This can be expected to affect the efficiency of 
operations and was a major area of concern to participants in our focus groups, as 
illustrated by the following quotes: 

• "Today I could solve that [a traffic conflict) with one transmission. Now it 
might require six transmissions before I could even begin to solve it, because 
there's no sense in me laying out clearances if all these other guys who are 
doing Free Flight are going to start cranking and banking without telling me 
or as they are telling me."* 

• Controller A: "How am I supposed to separate him from those airplanes 
when I don't know what he's doing. I want everybody to tell me before they 
are doing something." Controller B: "But that's not Free Flight." Controller 
A: "I know that." 

• "I can t very well give these guys an instruction based on what I hope the 
other guy is doing." 

As illustrated by these quotes, participating controllers consider knowledge of intent 
to still be critical in future air traffic management operations. While they are 
willing to give up continuous active control of aircraft in their sector, they still want 
to be informed about the plans and activities of pilots in a timely manner. This in 
line with the observation that "for agents to intentionally cooperate for their 
mutual benefit, they must have some common knowledge so that they can 
anticipate each other's actions and plan cooperative interactions. Cooperating 
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problem solvers, for example, can share high-level goals to improve the chances 
that they will cooperate effectively." (Durfee et al., 1990). 

7.3 Proposed Communication Channels and Technologies 
for Future ATM Operations. 

The primary medium for communication in future air traffic operations is expected 
to be Data Link, a two-way digital communication system that is currently under 
development. Some views of the future suggest that voice communication will still 
be available but will be considered a backup option to be used only in case of Data 
Link failures or to accommodate aircraft that are not equipped with the Data Link 
system. 

Most participants in our studies did not agree that the voice channel should become 
a back-up option in the future. For them, voice communication will still be the 
medium of choice for communicating clearances or requests that require immediate 
action and compliance. Such clearances may well turn out to represent the majority 
of messages sent by controllers, given that their role in future ATM operations will 
primarily be exception handling rather than control of routine operations. 

Participants in this project also cautioned that voice communication involves a 
number of benefits that would be lost with the introduction and significant use of 
digital communication. For example, with voice communication, information is 
not only shared by those immediately and directly affected by it but also by others on 
the same voice frequency. This allows them to anticipate and prepare for likely 
future clearances and actions (the so-called "party-line effect"). On modern 
automated aircraft, for example, this ability to anticipate clearances or problems 
allows pilots to preprogram their onboard systems ahead of time. In other words, 
the information that is shared on the voice channel helps them better distribute and 
balance their workload over time. 

Concerns were voiced not only about the potential loss of voice communication but 
also about a potential mismatch between future ATM operations and currently 
proposed protocols and interfaces for digital communication. Data Link, the 
envisioned digital communication system of the future, was originally developed to 
address existing problems with voice communication such as frequency congestion, 
call sign confusion, or poor transmission quality (Kerns, 1994). Its design seems to 
be driven primarily by the demands and properties of the current air traffic control 
system. It is therefore not clear that the resulting system design will also be as 
adequate for handling communication and coordination in future ATM operations. 

Some mismatches can be anticipated based on findings from simulation studies of 
two-way Data Link communication (for an overview see Kerns, 1994). These 
findings, while established in the context of simulations of current air traffic 
operations, have implications for future air traffic management as well. For 
example, a number of studies looked at the amount of time or the number of 



transmissions required to complete a communication when using Data Link versus 
voice communication. It was shown that total transaction time (i.e., entire time 
span when a controller would be concerned with a given communication) was twice 
as long for Data Link as for voice. This can be explained by various factors such as 
the possibility of delayed responses to DL messages or by more time being required 
to assemble DL messages. Another possible source of delayed responses is pilots' 
concerns about complying with clearances unless the system is capable of 
unambiguously identifying the source of a message and of ensuring its integrity. 
This requirement was identified in the literature and again emphasized by 
participants in this study, as illustrated by the following quote: 

• "I have to feel confident that that message is my message and it means I need 
to do that. In this [the current] environment, I know the guy's voice, I 
recognize the guy's voice from hearing it once or twice. ... But if you are just 
cruising along and at hour 2.5, a message pops up, 'turn left 240', you go 
'Why?' and do I have the confidence that that message is my message. ... We 
have to build the system to have a high degree of confidence, that the 
message has integrity and in fact has security." 

The ability to delay attending and responding to an incoming message until 
competing task demands allow for it can create problems with respect to the 
timeliness and relevance of information (Grice, 1975) and with respect to the 
establishment of mutual commitments to avoid a diffusion of responsibility 
Temporal gaps in the communication between two parties may require that once 
the conversation is picked up again, it may be necessary to first establish what has 
been and is now being talked about. 

Delays can also have detrimental effects on the important coordination of 
responsibilities between pilots and controllers. For example, there is evidence that 
controllers take feedback on the successful transmission of a message as evidence of 
the pilots' intention to comply with its content, although the pilot may not even 
have looked at the message yet (see Talotta et al., 1990). The omission of 
establishing mutual agreement about commitments before an action is taken is also 
seen in the case of pilots who initiate a requested maneuver before dispatching a 
response to the corresponding ATC clearance (Waller and Lohr, 1989). 

In summary, whatever the reason, the existing potential for delays in 
communication suggests that current Data Link implementations may not be 
suitable for handling communication in the future ATM environment where a lot 
of communication can be expected to be time-critical given the expected tactical 
approach to traffic management. Even for the current ATC system, many 
researchers and practitioners agree that Data Link should not be used to transmit 
time-critical immediate action messages. Still, the currently proposed design and 
operation of the system allows for and encourages such use of the system (Kerns, 
1994). As one controller in this study explained: 
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• "You and I are on a sector. I'm on the R [radar position], you are on the D side 
[data position). I need to tie up the radio and you've got access to Data Link. I 
tell you 'Dump this guy and turn this guy and climb this guy.' And you're just 
typing. Boom. Boom. Boom. They're gone. Because I am talking to this 
other guy on the radio." 

This new form of sharing responsibilities and communication tasks across a 
controller team involves a number of risks. In today's air traffic system, only the 
radar controller will talk to aircraft under his control even when several controllers 
are working a sector due to high traffic density and/or complexity. With the new 
proposed procedure, there is an increased risk that a member of the "radar team" 
can communicate a (erroneous) clearance to an aircraft without providing the radar 
controller with an opportunity for timely error detection and recovery. The need 
for new flexible procedures to support inter-controller coordination was identified 
in a study on the benefits of Data Link (Data Link Benefits Study Team, 1995). To 
date, however, the issue of additional coordination requirements between the radar 
controller and the D-side or even between the radar controller and other primary 
and secondary assistant controllers in high-workload operations has not been 
resolved. 

Another example of a proposed feature of Data Link that may be useful for the 
current ATC environment but less so for Free Flight operations is a message log for 
pilots and controllers to allow them to refer back to and review earlier clearances 
and communications. Free Flight is not going to involve as many, if any routine 
ground-initiated clearances. Also, Data Link will most likely be used to transmit 
routine communications while voice communication will be used for non-routine 
situations and for urgent messages (Billings, 1996; see also comments by controllers 
in this study). Thus, a critical proportion of air-ground exchange would still not be 
available for review by the crew or the controller. This may lead to confusion due to 
gaps in the log because of the inability to recreate the temporal sequence of voice and 
Data Link messages. 

Given the envisioned widely distributed network of decision-makers and actors in 
future ATM operations, the number of potential communication partners will 
increase. As a result, there is an increased need to address the issue of priorities and 
the coordination of transmissions. For the controller who is supposed to interfere 
only when safety requires him or her to do so, it is of utmost importance to have the 
highest priority at any time. Some controllers in our study were concerned and 
asked for clarification on this point: 

• "If I'm going to rely on Data Link to give control instructions that need 
somewhat close to an immediate response, am I going to have first priority of 
the Data Link or is dispatch going to have first priority if multiple 
transmissions are being received ? " 

• Another controller asked, "Do we have to compete to get in? " 
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One way of dealing with this message would be to tag messages according to their 
urgency — an option that has been proposed in the context of current Data Link 
designs. While it is technologically feasible to introduce such a function and while 
agreement on the associated procedure may be possible, it is important to keep in 
mind that this function involves a number of potential problems. First, it will 
create a new task for the sender and receiver of a message and create an additional 
step in the creation and screening of a message. Also, in the current voice 
communication environment, the urgency of a message is often inferred from 
implicit voice cues (in addition to explicit cues such as the use of the word 
"immediately") as confirmed by controllers in a number of surveys (e.g., Sarter and 
Woods, in preparation): 

• "I can tell immediately by the tone of his voice whether this is a 'do it 
immediately'." 

• "Today, when I check in on a frequency, within a minute I know what the 
workload of the controller is. And I know whether I can talk about things, or 
to just shut up until he's called and his ears pick up." 

As pointed out earlier, urgent messages may represent the majority of transmissions 
in the future tactical air traffic environment. As a result, their relative frequency 
may increase dramatically and with that, the informativeness of the label "urgent" 
can be questioned. 

Also, the urgency of a message in a widely distributed network of decision-makers 
and actors can not be determined by the sender alone. It is the result of an 
interaction between the intentions, actions, and limitations of both sender and 
receiver. Thus, currently proposed schemes may not be suitable for future ATM 
operations as they suggest that pilots and controllers do not have to attend to 
messages immediately unless it is urgent when, in fact, every message has to be 
checked by the receiver to determine urgency based on context. 

7.4 The Need for a Context-Dependent and Operator-Controlled 
Choice of Communication Media. 

Participants in our conceptual walkthroughs agreed that the key to successfully 
handling highly dynamic high-risk situations in the future ATM system will be a 
high degree of flexibility to allow for the context-dependent selection of 
communication media and protocols. They pointed out that in a situation such as 
the transition from Free Flight to a more controlled environment, the choice 
between Data Link and voice will depend on a variety of factors such as the urgency 
and length of messages that need to be transmitted, the ease with which messages 
can be assembled in either medium, and the equipment on board those aircraft that 
are affected by the transition. 
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Most likely. Data Link will be the preferred medium in situations where a 
precanned message can be sent to a number of aircraft or where a new broadcast 
message can be created very easily using the Data Link system. In contrast, 
controllers would prefer to use voice communication in case of an extremely urgent 
message or when numerous different messages need to be sent to a large number of 
aircraft. Still, even these preferences may change depending on the design and 
functionality of the Data Link system. Controllers explain that voice 
communication may no longer be their preferred technique if datablocks are 
updated automatically for them once a message has been sent and acknowledged. 
Both groups, pilots and controllers, agree that the choice of the communication 
medium should be left to the party initiating the communication, and that mixed 
protocols should be possible. This view does not coincide with current proposals 
calling for procedures to regulate the choice and combination of communication 
media. It also contradicts empirical findings which show that after working with 
mixed protocols, pilots and controllers in several studies (e.g., Hinton and Lohr, 
1988; Talotta et al., 1988) felt that switching between media was not desirable because 
of the difficulty in synchronizing the timing of the two media (Kerns, 1994). 

One of the few areas where pilots and controllers would prefer to maintain a high 
degree of regulation and standardization is in terms of phraseology. Standard 
phraseology is considered particularly important to avoid misunderstandings in 
situations that require immediate compliance with a clearance and also to allow 
controllers to create precanned messages for Data Link communication. For 
example, in a situation where the controller needs to take a large number of aircraft 
off their Free Flight status, standard agreed-upon phraseology would eliminate 
unnecessary requests for clarification and negotiation, and it could also be used to 
convey information such as the urgency of an action provided both controllers and 
pilots are well trained on the significance and meaning of standardized phrases. 

Negotiations of messages (especially controller instructions in case of time-critical 
situations) should not be allowed, in the view of most controllers and pilots: 

• "I can always get on the phone later and ask for an explanation (for why he 
was taken off Free Flight). It's not something to get in an argument about at 
30,000 ft when you're descending into LA." 

• "Once that (a controller clearance for traffic separation] is transmitted, in a 
form of action, it has to be executed immediately". 


7.5 The Need For Practice-Centered Displays For Data Link Communication 

Another area of concern that was discussed with pilots and controllers during the 
focus group meetings is the need for practice-centered feedback and interface design 
for digital communication. In particular, controllers were worried about new 
demands in terms of attention allocation across numerous displays and about an 
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increased need for focal visual attention. Earlier research indicates that an increased 
head-down time can be expected for pilots who may both want to read the message 
given that they can no longer listen to and share the information over their 
headphones. For controllers, there is a potential for an increased head-away time 
(away from the radar scope) if communication-related information is not integrated 
with that display. Given the large number of competing attentional demands, 
controllers would prefer at-a-glance displays that allow for parallel processing of 
different kinds of information. For example, the case of a transition from Free 
Flight to a more controlled environment potentially requires message 
acknowledgments by a large number of affected crews. These acknowledgments can 
not be handled via voice communication as the controller may have to use this 
channel for issuing urgent clearances. As long as other effective feedback 
mechanisms are provided, this does not create concerns among controllers: 

• "If I don't have to listen to it, and his transponder Mode S and Data Link and 
everything is feeding my radar display to where I don't have to listen to it, all 
I have to do is to scan visually; that would make less of an impact. If he starts 
to turn, it tells me." 

However, controllers are worried about having to track pilots' acknowledgments by 
referring to a separate message list. Instead, they suggested to have the color of 
affected radar targets and their datablocks change once an acknowledgment has been 
received by the Data Link system. Given that all affected aircraft are likely to be in 
close spatial proximity, this design would support pattern recognition. 

Some currently proposed Data Link designs already involve the integration of Data 
Link-related communication with the information on the radar scope. Attempts are 
being made in current designs to provide information on the contents and status of 
Data Link messages as part of the datablock of the affected aircraft. While this design 
moves in the direction desired by controllers in our studies, it still involves a 
number of problems. In particular, no indication is provided to indicate whether a 
message has actually been received (not only sent) and is currently being reviewed 
by the crew. 

Also, it is not clear that these proposed designs would work well for clearances 
involving multiple information elements. And finally, the addition of data to the 
datablock may seem unproblematic when applied to a single airplane. However, if 
applied to a large number of datablocks, this design will further increase the number 
of competing focal visual demands on controllers. 

More effective ways of providing information on the status and contents of Data 
Link messages as part of the datablock should be pursued, as they involve the 
potential for supporting error detection and recovery. For example, when the D- 
person is sending clearances to aircraft via Data Link, the change in datablock 
indications may help the radar controller keep track of his/her actions and notice 
erroneous inputs. 
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7.6 Concluding Remarks 


In summary, communication purposes and demands in future highly flexible ATM 
operations are likely to differ considerably from those in the current highly 
standardized and regulated ATC system. Communication will no longer serve the 
creation of agreed-upon commitments and thus long-term planning and control. 
Rather, it will be used to exchange information on actions already taken and to 
resolve time-critical conflict situations. Routine communications are more likely to 
be initiated by pilots to inform ground-based operators of their actions while conflict 
solutions will be communicated by controllers. 

The design of communication systems and protocols needs to be tailored to these 
demands and procedures to ensure highly efficient communication in the interest 
of coordination between airborne and ground-based operators. This research is a 
first step towards better understanding those new demands and, working in 
cooperation with practitioners, to explore the feasibility and effectiveness of various 
possible approaches to the exchange of information and the establishment of 
commitments in the context of Free Flight. 
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8.1 Statement of the fundamental problem and goal 

The fundamental problem motivating the search for new technologies to support a 
more capable air traffic management system is the inflexibility of today's 
increasingly crowded air traffic management system, which is inefficient and costly 
for users of the airspace. The goal of the AATT project is to assist in the design of an 
air traffic management system that will increase the ability of all suitably equipped 
aircraft to fly when and where they wish under all flight conditions, with at least as 
high a level of safety as is now available in the current air traffic management 
system. 


8.2 Dimensions of the problem space 

Drawing on the data collected in these studies, we have conceptualized this problem 
in terms of several physical and operational parameters, and a number of variables 
that relate to the processes necessary to accomplish the objectives of the system. 
Considered as a whole, these parameters and variables may be thought of as 
defining a problem space, within which a solution space may be hypothesized. 

8.2.1 Physical Parameters 

The physical parameters of primary importance include (but may not be limited to): 

• The dimensions and characteristics of the usable airspace within which 
operations are to be conducted; 

• The number, type and position of airports suitable for those operations; 
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• The aerodynamic characteristics of the vehicles operating in that airspace and 
to and from those airports; 

• The precision within which the airspace itself, and vehicle positions and 
states within that airspace, can be defined on a dynamic or real-time basis; 

• The availability of position and state sensors, and their precision under both 
nominal and worst-case conditions; 

• The availability and capacity of real-time communications media to permit 
information transfer within the system and among its participants and 
stakeholders. 

8.2.2 Operational Parameters 

The operational parameters of primary importance include: 

• The range of operational capabilities required by system users (general 
aviation, air carriers, the armed forces and other users must be considered); 

• The constraints under which system users wish to or must operate, and the 
regulatory infrastructure that controls and constrains their operations; 

• The ability of system users to equip their aircraft with necessary technologies; 

• The range of capabilities of the operators of aircraft, and of the ATM 
infrastructure. 

8.2.3 Major Variables 

The variables of primary importance in such a system relate mostly to information 

relating to, or generated by, the system. They include: 

• The processes, policies and procedures under which the system will be 
operated; 

• The agreed-on methods by which the system is to be controlled and managed; 

• The information that is made available by operators, the ATM system and 
others; 

• The degree to which that information is accessible to other operators and 
users; 

• The methods by which information is transferred; 

• The loci of control of the system under normal and contingency conditions; 

• The spans of control and management of the various system participants 
(human and machine). 
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The aviation system is information-bound. It is able to function only to the extent 
that various operators have access to information concerning both their own 
operation and the operations of others, and information concerning the 
environment in which they are operating and will operate in the near future. (This 
is sometimes referred to as "situation awareness".) The management of the system 
is constrained by the manager's ability to manage information that describes the 
environment, objects being moved within it, and the intentions of the participants. 

8.3 Bounding the dimensions of the problem 

Each of these parameters and variables has limits that are relevant to the goal and to 
a definition of a problem space that is bounded enough to be tractable. An attempt 
is made to do this here. 

8.3.1 Physical parameters 

x 

We assume that the physical dimensions and characteristics of the airspace are to 
remain as at present, with certain specific exceptions: 

• Military special-use airspace will be made available for civil operations at any 
times when it is not in active use. Its physical dimensions may also be 
dynamic; 

• Terminal (departure and arrival) airspace will be controlled only as required; 
its spatial dimensions will typically vary dynamically based on need. 

Airspace parameters must therefore be thought of in both spatial and temporal 
terms. 

Airports, with a few exceptions, will remain as at present. A small number of 
additional runways may become available, but the principal difference from today's 
operations is that runways will be more heavily used. There will be continuing and 
increasing pressure to minimize runway occupancy times. Aircraft surface 
movements at high-density airports may be controlled automatically to a limited 
extent to permit more operations under extremely restricted visibility conditions. 

While the types of aircraft in the system will not differ appreciably from those in use 
today, a decreasing number (except in the near term) will be "first-generation" 
machines. An increasing majority of aircraft will have relatively high power-to- 
weight ratios under normal operating circumstances. They will therefore be 
somewhat more agile. Most transport and many business aircraft will have at least 
a flight management system with vertical navigation capability. Nearly all will 
have collision avoidance systems of some kind, and a large number will have data 
link capability (mode S or other). 

Airspace physical dimensions can be very precisely defined with present technology. 
The challenge in this area will be the pressure to delimit or restrict airspace only 
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when operational necessity dictates (temporal dimensions). Dynamic airspace 
reservation implies the existence of means whereby information concerning 
dynamic airspace dimensions and rules for its use can be made known instantly to 
those who may wish to use it, or may need to avoid it. We assume that aircraft 
positions, states, and instantaneous velocity vectors can be defined precisely 
enough, using presently-available technology, so that data concerning them can be 
considered "true" and current. Constraints are likely to be due to problems in 
information management rather than problems in generating the information. 

If the above assumptions are correct, the physical parameters of the future system 
can be fairly precisely defined except to the extent that they become dynamic. The 
issue of critical importance becomes the ability to transfer information, which is or 
will be available, among the system operators who may have need for it under any 
operating circumstances. As noted, the present system is information-bound. A 
more dynamic system will be even more dependent on our ability to manage 
information, and there will be more, and more dynamic, information to manage. 

8.3.2 Operational Parameters 


These parameters must be defined by consensus among system participants. Once 
defined, they will become, in effect, system constants. We believe that the range of 
operational capabilities that the system can support will not change greatly during 
the period of definition of the future system, though there will be additional 
requirements placed on specific parts of the system (primarily low-altitude sectors). 

Air carriers desire markedly increased system capability to accommodate flexible 
operations within which tactical changes in objectives can be dealt with in real time. 
They want, at least for their aircraft, the ability to utilize "best" routings without 
hindrance (and "best" may be defined differently by various system participants, or 
even by the same participants operating under differing constraints imposed by 
weather, equipment availability or passenger demand). Operators may be expected 
to echo the desire for flexible operations whose trajectories can be defined in real 
time to accommodate changing circumstances. 

Air carriers, operating under FAR Part 121, will be willing to accept the constraints 
imposed by the FAA in the interests of maintaining the highest level of safety. 
Other operators, however, are not bound by these regulations. As they become 
more sophisticated, they may be expected to press for the ability to conduct 
operations permitted by FAR Part 91 under all circumstances. The implications for 
the ATM system of this have not been considered in depth. 

For some years to come, there will be considerable differences among operators in 
the sophistication of their avionics suites. Initial plans suggest that the future ATM 
system must accommodate the entire spectrum of aircraft, but we believe there may 
be considerable pressure on operators to invest in advanced avionics in order to be 
able to realize maximum system capabilities. 
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There remains the important question of operator capabilities. ICAO has set forth 
minimum standards for aircrew, and nearly all nations adhere to these standards or 
to similar national regulations. The facts are, however, that while minimum 
standards may be met by all, there remain substantial differences among nations 
and regions as to the average capabilities of their commercial pilots and their air 
traffic controllers. There are still large regions in which air traffic control, and air 
navigation equipment, are not fully reliable, and some nations whose pilots do not 
operate to what we would consider optimal standards. We have listed this as a 
parameter because these capabilities will improve, at best, only very slowly over 
time. The globalization of air transport means, among other things, that operators 
from these nations operate over our land mass, and our operators operate over 
theirs. The future system must be sufficiently tolerant of differences in human and 
equipment capabilities to permit operations, wherever they may occur, at a 
uniformly high level of safety. 

8.3.3 System variables 

In addition to these parameters, a host of variables must be taken into account in 
planning for a future system. These variables, however, can be controlled to a 
greater extent than the parameters considered above. As noted earlier, the most 
important ones relate in some way to the handling of information in the system, 
because it is information that ties this very complex, dynamic, highly-distributed 
system together. The system has many loci of control: air traffic control and air 
traffic management centers, airline operations centers, and aircraft. All must 
operate cooperatively, in agreed-upon ways, if the system is to be successful. 

These agreements, however reached and codified, constitute the body of philosophy, 
policies, procedures and practices (Degani & Wiener, 1995) that govern operations in 
the aviation system. This fact implicitly recognizes that the goal cannot be met in 
an unconstrained system; the solution space will be more constrained than the 
problem space. It also means that the ground and flight subsystems must be 
integrated by agreements as to the methods by which air commerce will be 
conducted. 

These methods, or procedures, will indicate what aircraft trajectories are, or are not, 
permissable under the range of circumstances that may obtain in the system. They 
may differ as a function of the technologies available in a particular region; they 
should (but may not) differ as a function of the capabilities of the various human 
and machine participants. They must obviously be known to all participants in a 
given area, which implies that ad hoc rules and agreements are not desirable. 

The procedures, and their implementation, rest upon a body of philosophy and 
policies adhered to by controlling bodies (usually governments) and operators. For 
this reason, the philosophy and policies must also be known to all system 
participants. This has not been the case in the past, and it may not be the case in the 
future. Many “private agendas" govern operator methods, and some of them 
involve competitive considerations, at least in the United States and increasingly, 
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elsewhere as air transport becomes more competitive world-wide. The extent to 
which proprietary considerations threaten system integrity is not known, but 
enough is known to state with confidence that the overarching philosophy and 
policies must form boundaries outside which operators cannot stray. 

If such boundaries are to exist, and if a common operating philosophy is to govern 
all system participants, there must clearly be a body which can act as a repository for 
the agreements, a “referee" when participants disagree about operating methods, 
and an enforcement mechanism when agreed-upon operating practices are 
transgressed. This body is also a logical repository for dynamic information 
concerning the system, though it does not represent the only possible solution for 
the information management requirements of the system. Only if this body has the 
ability to compel participants to conduct operations within its rules, however, and 
to provide information necessary to the conduct of air commerce, will the 
enterprise be successful; for that reason, it can be argued that it should be a 
governmental body. 

There are two major classes of direct participants in the present system: users (in 
airlines, this includes flight crews, dispatchers and airline operations centers that 
direct them, and other management and support staff) and providers (air traffic 
controllers and managers). At this time, each class of participant has well-defined 
responsibilities, and usually well-defined authority to meet its responsibilities. 
Flight crews and dispatchers are responsible for the safe conduct of their own 
individual flights and fleets; air traffic controllers and managers are responsible for 
the safe conduct of air traffic. Each class of human operators is assisted by a variety 
of automated tools, though controllers presently have less advanced automation 
technology at their disposal than do the other operators in the system. 

It can be argued that air traffic control and maintenance of separation between 
aircraft is the most difficult task in air commerce, and that this task will become 
more difficult as demand for air transportation increases. This reasoning has led 
system overseers to propose that advanced automation for the performance of this 
task should be the highest priority of system designers. Indeed, it appears that a 
major part of air traffic management system redesign is devoted to this task, though 
considerable effort is also being applied to upgrading aviation communications 
systems as well. 

Our conceptualization of the problem space, above, suggests that fully adequate 
information management capability may be at least as important as tools to assist 
controllers in maintaining separation. It can even be argued, as an extreme 
position, that if fully adequate information concerning the system were available to 
all operators on a real-time basis, losses of separation among aircraft would be much 
less likely to occur, since operators could plan and conduct their operations with 
foreknowledge of possible conflicts between themselves and others. 

The availability of data concerning system parameters and variables is not enough, 
in and of itself, to permit safe system operation. These data must be properly 
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transformed, integrated and represented to the various system operators in such a 
way that they tell operators what they need to know, when they need to know it, in 
order to make uniformly intelligent decisions about their conduct of operations. 
The present system's information management infrastructure is a patchwork of 
equipment and methods developed over many years. It is less than adequate to 
meet operator needs now, and it will become grossly inadequate in the near future. 
Though much research and development is ongoing, especially with regard to high- 
bandwidth digital communications capability (digital data link, see report no. 7), 
more research is required to delineate more precisely the information requirements 
among system participants; the lack of such information is a major part of the 
problem. 

One final note with regard to variables: Automation can limit the authority and 
span of control of human operators in the system. It already does so in advanced 
aircraft, and it may do so to air traffic controllers as the ATC system becomes more 
automated. We believe that responsibility for system safety and authority to operate 
the system must reside in the same locus of control. If humans are to remain 
responsible, they must have the authority to override their automated tools. This 
becomes increasingly difficult as automation becomes more autonomous and 
authoritarian. The limits of authority of new automation must be clearly spelled 
out at the conceptualization stage, to insure that fundamental system principles and 
practices can be maintained under all circumstances. 

8.4 The Range of Solution Options 

The next-generation aviation system will not be fully automated, either on the 
ground or in the air. We do not believe that the capability exists at this time, with 
today's technology, to build either fully autonomous aircraft or a fully automated air 
traffic management system. We also believe that social and political constraints 
would make the use of such systems unacceptable to customers and managers alike 
even if they could be designed, built and validated. For that reason, we suggest that 
the next-generation system must continue to be a cooperative human-machine 
system, in which human operators will continue to be the ultimate defense against 
system failure. 

This being the case, we suggest that the solution space for the future system must be 
limited to solutions in which human system participants remain in a position of 
primacy over machines. Much more automation will be required to meet future 
challenges, but that automation should be designed to assist humans in doing their 
jobs within the system, rather than supplanting them. This implies that the 
automation must be human- or user-centered; that automation technology must be 
designed as a set of tools that humans can use to accomplish tasks necessary to safe 
system operations. 

Further constraints will govern the solution space for a future aviation system. 
They are presented as discussed in previous sections. 
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8.4.1 The physical environment 


The physical and temporal characteristics of the usable airspace will continue to be 
governed by convective weather phenomena, and to a lesser extent by precipitation 
activity, both of which vary dynamically. Aircraft will continue to avoid, rather 
than deal with, convective activity; snow and sleet will continue to be a major 
problem at and in the vicinity of airports. The future system will continue to be 
plagued by certain types of weather, though new technology can help to deal with 
problems of low visibility due to fog. 

Because of this, the future system must be sufficiently flexible to accommodate and 
deal with large-scale disruptions of air movements when these phenomena are 
active. Its present inability to do so in a way that meets airline needs will be a source 
of continuing pressure from these operators, and more effective contingency 
management should be a major sub-goal in system redesign. This issue needs more 
research than it has received. 

While today's sensor systems can locate aircraft with high precision, the ability to 
transfer and represent these data in real time may continue to pose a serious 
problem. Enormous quantities of electromagnetic spectrum resources will be 
required to provide all system participants in real time with all the information 
they need to conduct operations intelligently. This has the potential to become a 
major system bottleneck, for aviation communications will increasingly be forced to 
compete with other communications in an increasingly information-driven society. 
We have already seen problems due to this competition. 

8.4.2 The operational environment 

While some have suggested that the future operational environment can become 
simpler to understand and less constrained by strategic considerations if a free flight 
approach is adopted, we believe that this suggestion is simplistic. A lessening of 
dependence on strategic air traffic management will require that operational 
decisions be made more rapidly when problems arise, and will also require that 
solutions be based on less information than is presently incorporated into such 
decisions, because intent information may not always be available and there may 
not be time to seek it out. 

We believe, and the data reported in this volume strongly support this belief, that 
the aviation system must continue to have access to information concerning the 
intentions of all system participants, because situation awareness requires the ability 
to predict near-term future system states (see reports nos. 3 and 5 in this volume). 
This is true whether humans, or computers, are in control. We therefore believe 
that the future system must continue to rely on intent information, and that means 
must be found to improve the quality and ease of transfer of this information 
among participants. 
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We think it likely that if there is sufficient demand for advanced tools to permit full 
participation in a future system, avionics manufacturers will produce these tools 
and will make them affordable to those who wish to purchase them. This has 
already occurred with respect to satellite-based navigation systems, just as it earlier 
occurred with respect to advanced navigation and communications systems for 
general aviation; even before GPS became available, nearly 50% of general aviation 
aircraft had some area navigation capability. 

The capabilities of aircraft operators is a more difficult issue. Aircraft operators in 
the United States vary greatly in their abilities and proficiency, as well as in the tools 
they possess to aid them in functioning within the system. We believe this 
disparity among operators will continue. We are not sure that the solution space 
for a future aviation system can be enlarged enough to meet the needs of the 
present population of pilots wishing to utilize it, but political realities dictate that 
every effort should be made to keep the space as wide as possible in deference to this 
population. Nonetheless, significant compromises may be required to make the full 
capabilities of the system available to all who wish to use them. 

The problem with regard to other areas of the world is even more difficult, and 
perhaps insoluble in the near term. This dictates that aircraft capable of operations 
to and from those areas must be prepared to operate, under all conditions, without 
many of the capabilities that their operators are used to having in flying within the 
United States or other technologically advanced areas. International transport pilots 
now become used to conducting much of their own air traffic surveillance, using 
voice transmissions, TCAS and their own eyes, because they know that air traffic 
control in those areas may be unreliable. The future system must be designed in 
such a way that it does not lessen the ability of pilots to take on these additional 
responsibilities where they are required. Growing dependence on data link as a 
means of discrete communication between aircraft and the ground infrastructure 
could rob pilots of information they now need in these areas, as an example, 
although it could appreciably ease some of the present problems due to disparities in 
English language capability (see report no. 7 in this volume). 

8.4.3 System variables 

As we believe that information management and transfer are the central problems 
facing us in working toward a future aviation system, we also believe that the 
dimensions of the solution space will ultimately be constrained by our ability to 
conceptualize the future system in terms that permit solutions for this central set of 
problems. 

It is our view that the future system's effectiveness will rest primarily upon the 
effectiveness of its information management. This view encompasses all facets of 
information generation and handling. This is an area in which advanced 
technology can be of the greatest help to the humans who must manage and operate 
the system. It is vital, however, that the conceptual architecture of candidate 
systems be worked out in advance of system design, to guide the information 
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management requirements and the design of technologies necessary to aid 
information flow and representation in the various parts of the system. 

The system architecture must be guided by the overall system philosophy, which 
will also motivate the assignment and distribution of operating tasks to be 
performed; these, in turn, will govern the information necessary for operators, and 
the forms that information should take. These decisions, in turn, should enable 
decisions to be made about the types of automation necessary to assist human 
operators and managers of the system. 

In other words, it is our belief that several major efforts need to precede detailed 
system design. We believe that technology to assist humans in managing any of 
several candidate systems is technically feasible, whereas technology to manage a 
future system autonomously is not. We believe that a system in which human- 
centered automation assists humans in system management and operation is likely 
to provide the flexibility that will be required, while a system that depends more 
heavily on automation itself for its operation is likely to be brittle and inflexible. 

8.5 Integration and Coupling in a Future System 

We have indicated above that we believe that future system integration should be 
accomplished by means of a philosophy, policies and procedural rules, understood 
and agreed to by all system participants. Such a system will need to be be flexible as 
well as capable, in recognition that there will inevitably be operational conditions 
not predicted nor provided for by system designers. In a system with the amount of 
uncontrollable variability that exists in the aviation system, this is a conservative 
and prudent approach. 

We are concerned about the amount of coupling, or interdependence among system 
components, that would be required in a fully-automated system. In past heavily- 
automated systems, this coupling has increased system brittleness at the margins of 
the system's operating envelope. It has led to such systems becoming more opaque 
to human operators, and has therefore increased the likelihood that human system 
operators or managers will be surprised by system behavior. We therefore believe 
that this enormous system redesign task should incorporate conservative design 
approaches, that the future system should be as evolutionary as possible, and that as 
much use as possible should be made of the enormous amount of human expertise 
and capability now existing. It is these human experts who will be relied upon to 
operate, supervise and manage the future system. Their collective capabilities, 
properly enhanced by new technology, represent the greatest asset we have, and 
should be the basis upon which the future system is founded. 
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